@h-rig/provider-plugin 0.0.6-alpha.156 → 0.0.6-alpha.158

package/dist/src/plugin.js

@@ -14,6 +14,2311 @@ var __export = (target, all) => {
     });
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = import.meta.require;
+
+// packages/provider-plugin/src/agent-harness/controlled-bash.ts
+import { existsSync } from "fs";
+import { resolve } from "path";
+import { resolveRigLayout } from "@rig/core/layout";
+function controlledBashCandidates(projectRoot) {
+  const layout = resolveRigLayout(projectRoot);
+  const candidates = [
+    process.env.RIG_CONTROLLED_BASH_BIN?.trim() || "",
+    resolve(layout.binDir, "controlled-bash"),
+    Bun.which("controlled-bash") || ""
+  ];
+  return candidates.filter((candidate) => Boolean(candidate));
+}
+function resolveControlledBash(projectRoot) {
+  for (const candidate of controlledBashCandidates(projectRoot)) {
+    if (existsSync(candidate))
+      return candidate;
+  }
+  return null;
+}
+async function runControlledBash(args, options) {
+  const projectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || process.env.PROJECT_RIG_ROOT?.trim() || process.env.RIG_TASK_WORKSPACE?.trim() || process.cwd() || options.projectRootFallbackDir;
+  const controlled = resolveControlledBash(projectRoot);
+  if (!controlled) {
+    console.error("[rig-agent] controlled-bash entrypoint unavailable; refusing to run an unguarded shell.");
+    return 126;
+  }
+  const command = [controlled, ...args];
+  const child = Bun.spawn(command, {
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit",
+    cwd: process.cwd(),
+    env: {
+      ...process.env,
+      PROJECT_RIG_ROOT: projectRoot,
+      RIG_BASH_ACTIVE: "1"
+    }
+  });
+  return await child.exited;
+}
+var init_controlled_bash = () => {};
+
+// packages/provider-plugin/src/agent-harness/agent-mode.ts
+function looksLikeShellInvocation(args, mode = process.env.RIG_AGENT_MODE) {
+  if (mode === "shell") {
+    return true;
+  }
+  if (mode === "agent") {
+    return false;
+  }
+  if (args.length === 0) {
+    return false;
+  }
+  const first = args[0];
+  if (!first) {
+    return false;
+  }
+  const bashLikeFlags = new Set([
+    "-c",
+    "-lc",
+    "-l",
+    "-i",
+    "-s",
+    "--login",
+    "--noprofile",
+    "--norc",
+    "--posix",
+    "--rcfile",
+    "--init-file",
+    "--restricted",
+    "--debug",
+    "--debugger",
+    "--verbose",
+    "--wordexp",
+    "--dump-strings",
+    "--dump-po-strings",
+    "--help"
+  ]);
+  if (bashLikeFlags.has(first)) {
+    return true;
+  }
+  if (!first.startsWith("-")) {
+    return first.endsWith(".sh");
+  }
+  return false;
+}
+
+// packages/provider-plugin/src/agent-harness/git-ops.ts
+import { LIFECYCLE_GIT_AGENT } from "@rig/contracts";
+import { defineCapability } from "@rig/core/capability";
+import { buildPluginHostContext } from "@rig/core/plugin-host-context";
+import { loadCapabilityForRoot } from "@rig/core/capability-loaders";
+async function ensureHostContext(projectRoot) {
+  let cached = hostContextByRoot.get(projectRoot);
+  if (!cached) {
+    cached = buildPluginHostContext(projectRoot);
+    hostContextByRoot.set(projectRoot, cached);
+  }
+  await cached;
+}
+async function loadLifecycleGit(projectRoot) {
+  await ensureHostContext(projectRoot);
+  const git = await loadCapabilityForRoot(projectRoot, LifecycleGitAgentCap);
+  if (!git) {
+    throw new Error("lifecycle git capability unavailable: load @rig/bundle-default-lifecycle (default bundle) before running rig-agent git commands.");
+  }
+  return git;
+}
+var LifecycleGitAgentCap, hostContextByRoot;
+var init_git_ops = __esm(() => {
+  LifecycleGitAgentCap = defineCapability(LIFECYCLE_GIT_AGENT);
+  hostContextByRoot = new Map;
+});
+
+// packages/provider-plugin/src/agent-harness/repo-ops.ts
+import { existsSync as existsSync2, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "fs";
+import { basename, dirname, resolve as resolve2 } from "path";
+import { loadRuntimeContext } from "@rig/core/runtime-context";
+import {
+  MANAGED_REPO_SERVICE_CAPABILITY,
+  TASK_DATA_SERVICE_CAPABILITY
+} from "@rig/contracts";
+import { defineCapability as defineCapability2 } from "@rig/core/capability";
+import { getInstalledCapability, requireInstalledCapability } from "@rig/core/capability-loaders";
+import { resolveHarnessPaths } from "@rig/core/harness-paths";
+function runCapture(command, cwd, env) {
+  const result = Bun.spawnSync(command, {
+    cwd,
+    env: env ? { ...process.env, ...env } : process.env,
+    stdout: "pipe",
+    stderr: "pipe",
+    stdin: "ignore"
+  });
+  return {
+    exitCode: result.exitCode,
+    stdout: result.stdout.toString(),
+    stderr: result.stderr.toString()
+  };
+}
+function readJsonFile(path, fallback) {
+  if (!existsSync2(path))
+    return fallback;
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return fallback;
+  }
+}
+function nowIso() {
+  return new Date().toISOString();
+}
+function managedRepoEntries() {
+  return getManagedRepoService()?.listManagedRepoEntries() ?? [];
+}
+function requireManagedRepoService() {
+  const service = getManagedRepoService();
+  if (!service) {
+    throw new Error("managed-repo service not installed: configure @rig/repos-plugin in rig.config to use managed-repo operations.");
+  }
+  return service;
+}
+function primaryManagedRepoId() {
+  const entries = managedRepoEntries();
+  return entries.length > 0 ? entries[0].id : null;
+}
+function primaryManagedRepoAlias() {
+  const entries = managedRepoEntries();
+  return entries.length > 0 ? entries[0].alias : null;
+}
+function repoEnsure(projectRoot, taskId) {
+  const monorepo = ensureMonorepoReady(projectRoot);
+  const resolvedTask = taskId || taskData().currentTaskId(projectRoot);
+  if (!resolvedTask) {
+    if (monorepo) {
+      const alias = primaryManagedRepoAlias();
+      if (alias) {
+        persistBaselinePins(projectRoot, { [alias]: monorepo.headCommit });
+      }
+    }
+    console.log("No active task. Refreshed baseline repo pins.");
+    return;
+  }
+  const pins = resolvedPins(projectRoot, resolvedTask);
+  applyPins(projectRoot, pins);
+  verifyPins(projectRoot, pins);
+}
+function repoPins(projectRoot, taskId) {
+  const resolvedTask = taskId || taskData().currentTaskId(projectRoot);
+  if (!resolvedTask) {
+    return {};
+  }
+  return resolvedPins(projectRoot, resolvedTask);
+}
+function repoVerify(projectRoot, taskId) {
+  const resolvedTask = taskId || taskData().currentTaskId(projectRoot);
+  if (!resolvedTask) {
+    console.log("No active task. Nothing to verify.");
+    return true;
+  }
+  const pins = resolvedPins(projectRoot, resolvedTask);
+  return verifyPins(projectRoot, pins);
+}
+function repoDiscover(projectRoot, taskId) {
+  const resolvedTask = taskId || taskData().currentTaskId(projectRoot);
+  if (!resolvedTask) {
+    return {};
+  }
+  const explicit = explicitPins(projectRoot, resolvedTask);
+  if (Object.keys(explicit).length > 0) {
+    return explicit;
+  }
+  return discoverPins(projectRoot, resolvedTask);
+}
+function repoBaseline(projectRoot, refresh = false) {
+  const paths = resolveRepoDiscoveryPaths(projectRoot);
+  if (!refresh && existsSync2(paths.baseRepoPinsPath)) {
+    const baseline = readJsonFile(paths.baseRepoPinsPath, { recorded_at: nowIso(), repos: {} });
+    return baseline.repos || {};
+  }
+  const id = primaryManagedRepoId();
+  if (!id) {
+    return persistBaselinePins(projectRoot, {});
+  }
+  const synced = requireManagedRepoService().syncManagedRepo(projectRoot, id);
+  const alias = primaryManagedRepoAlias() ?? id;
+  return persistBaselinePins(projectRoot, { [alias]: synced.headCommit });
+}
+function ensureMonorepoReady(projectRoot) {
+  const id = primaryManagedRepoId();
+  if (!id) {
+    return null;
+  }
+  const synced = requireManagedRepoService().syncManagedRepo(projectRoot, id);
+  const sha = synced.headCommit.slice(0, 7);
+  console.log(`Monorepo ready: ${synced.layout.alias}@${sha}`);
+  return synced;
+}
+function persistBaselinePins(projectRoot, repos) {
+  const paths = resolveRepoDiscoveryPaths(projectRoot);
+  mkdirSync(resolve2(paths.baseRepoPinsPath, ".."), { recursive: true });
+  writeFileSync(paths.baseRepoPinsPath, `${JSON.stringify({ recorded_at: nowIso(), repos }, null, 2)}
+`, "utf-8");
+  return repos;
+}
+function resolvedPins(projectRoot, taskId) {
+  const explicit = explicitPins(projectRoot, taskId);
+  if (Object.keys(explicit).length > 0) {
+    return explicit;
+  }
+  return discoverPins(projectRoot, taskId);
+}
+function explicitPins(projectRoot, taskId) {
+  const repoPins2 = readRepoDiscoveryTaskConfig(projectRoot)[taskId]?.repo_pins || {};
+  const normalized = {};
+  const validAliases = new Set(managedRepoEntries().map((e) => e.alias));
+  for (const [key, value] of Object.entries(repoPins2)) {
+    if (!value) {
+      continue;
+    }
+    if (validAliases.size > 0 && !validAliases.has(key)) {
+      throw new Error(`Unsupported repo pin key for ${taskId}: ${key}. Known aliases: ${[...validAliases].join(", ") || "(none registered)"}`);
+    }
+    const existing = normalized[key];
+    if (existing && existing !== value) {
+      throw new Error(`Conflicting explicit repo pins for ${key}: ${existing} vs ${value}`);
+    }
+    normalized[key] = value;
+  }
+  return normalized;
+}
+function taskDependencies(projectRoot, taskId) {
+  return taskData().taskDependencyIds(projectRoot, taskId);
+}
+function discoverPins(projectRoot, taskId) {
+  const deps = taskDependencies(projectRoot, taskId);
+  if (deps.length === 0) {
+    return repoBaseline(projectRoot, true);
+  }
+  const paths = resolveRepoDiscoveryPaths(projectRoot);
+  const state = readJsonFile(paths.taskRepoCommitsPath, {});
+  const pinKeys = managedRepoEntries().map((e) => e.alias);
+  if (pinKeys.length === 0) {
+    return {};
+  }
+  const discovered = {};
+  for (const key of pinKeys) {
+    const commits = new Set;
+    for (const dep of deps) {
+      const fromState = state[dep]?.repos?.[key];
+      if (fromState) {
+        commits.add(fromState);
+      }
+      const fromArtifact = readPinFromArtifact(projectRoot, dep, key);
+      if (fromArtifact) {
+        commits.add(fromArtifact);
+      }
+    }
+    if (commits.size > 1) {
+      const values = [...commits].join(`
+  - `);
+      throw new Error(`Conflicting discovered pins for ${key} from dependency graph of ${taskId}:
+  - ${values}`);
+    }
+    if (commits.size === 1) {
+      discovered[key] = [...commits][0];
+    }
+  }
+  return discovered;
+}
+function readRepoDiscoveryTaskConfig(projectRoot) {
+  try {
+    return taskData().readSourceTaskConfig(projectRoot);
+  } catch {
+    return taskData().readTaskConfig(projectRoot);
+  }
+}
+function resolveRepoDiscoveryPaths(projectRoot) {
+  const monorepoRoot = requireManagedRepoService().resolveMonorepoRepoLayout(projectRoot).checkoutRoot;
+  const explicitHostProjectRoot = (process.env.RIG_HOST_PROJECT_ROOT || "").trim();
+  const normalizedProjectRoot = resolve2(projectRoot);
+  const hostProjectRoot = explicitHostProjectRoot && shouldUseHostProjectStateRoot(normalizedProjectRoot) ? explicitHostProjectRoot : normalizedProjectRoot;
+  const stateDir = resolve2(hostProjectRoot, ".rig", "state");
+  return {
+    monorepoRoot,
+    taskRepoCommitsPath: resolve2(stateDir, "task-repo-commits.json"),
+    baseRepoPinsPath: resolve2(stateDir, "base-repo-pins.json")
+  };
+}
+function shouldUseHostProjectStateRoot(projectRoot) {
+  const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (runtimeWorkspace && resolve2(runtimeWorkspace) === projectRoot) {
+    return true;
+  }
+  return basename(dirname(projectRoot)) === ".worktrees";
+}
+function readPinFromArtifact(projectRoot, depTask, repoKey) {
+  const snapshot = resolve2(taskData().artifactDirForId(projectRoot, depTask), "git-state.txt");
+  if (!existsSync2(snapshot)) {
+    return "";
+  }
+  const content = readFileSync(snapshot, "utf-8");
+  const chunk = content.split(/\r?\n/);
+  let inSection = false;
+  for (const line of chunk) {
+    if (line.startsWith("## ")) {
+      inSection = line.startsWith(`## ${repoKey}`);
+      continue;
+    }
+    if (!inSection) {
+      continue;
+    }
+    if (line.startsWith("head:")) {
+      return line.replace(/^head:\s*/, "").trim();
+    }
+  }
+  return "";
+}
+function repoPath(projectRoot, key) {
+  const managed = getManagedRepoService()?.resolveManagedRepoLayoutByAlias(projectRoot, key) ?? null;
+  if (managed) {
+    return managed.checkoutRoot;
+  }
+  return key.startsWith("/") ? key : resolve2(projectRoot, key);
+}
+function applyPins(projectRoot, pins) {
+  for (const [key, commit] of Object.entries(pins)) {
+    const path = repoPath(projectRoot, key);
+    if (!existsSync2(resolve2(path, ".git"))) {
+      throw new Error(`Repo for pin not available: ${key} (${path})`);
+    }
+    let hasCommit = runGitCapture(["git", "-C", path, "cat-file", "-e", `${commit}^{commit}`], projectRoot).exitCode === 0;
+    if (!hasCommit) {
+      runGitCapture(["git", "-C", path, "fetch", "--all", "--tags", "--prune"], projectRoot);
+      hasCommit = runGitCapture(["git", "-C", path, "cat-file", "-e", `${commit}^{commit}`], projectRoot).exitCode === 0;
+    }
+    if (!hasCommit) {
+      throw new Error(`Commit not found for ${key}: ${commit}`);
+    }
+    const current = runGitCapture(["git", "-C", path, "rev-parse", "HEAD"], projectRoot).stdout.trim();
+    if (current === commit) {
+      console.log(`Repo pin: ${key} already at ${commit}`);
+      continue;
+    }
+    const branch = runGitCapture(["git", "-C", path, "rev-parse", "--abbrev-ref", "HEAD"], projectRoot).stdout.trim();
+    const checkout = branch.startsWith("rig/") ? runGitCapture(["git", "-C", path, "reset", "--hard", commit], projectRoot) : runGitCapture(["git", "-C", path, "checkout", "--detach", commit], projectRoot);
+    if (checkout.exitCode !== 0) {
+      throw new Error(`Failed to apply repo pin ${key} -> ${commit}:
+${checkout.stderr || checkout.stdout}`);
+    }
+    console.log(`Repo pin: ${key} -> ${commit}`);
+  }
+}
+function verifyPins(projectRoot, pins) {
+  let ok = true;
+  for (const [key, expected] of Object.entries(pins)) {
+    const path = repoPath(projectRoot, key);
+    if (!existsSync2(resolve2(path, ".git"))) {
+      console.error(`ERROR: repo missing during pin verification: ${key}`);
+      ok = false;
+      continue;
+    }
+    const current = runGitCapture(["git", "-C", path, "rev-parse", "HEAD"], projectRoot).stdout.trim();
+    if (current === expected) {
+      console.log(`Repo verify: ${key} at ${current}`);
+    } else {
+      console.error(`ERROR: repo pin mismatch for ${key}: expected ${expected}, got ${current}`);
+      ok = false;
+    }
+  }
+  return ok;
+}
+function runGitCapture(command, projectRoot) {
+  return runCapture(command, projectRoot, resolveRuntimeGitEnv());
+}
+function resolveRuntimeGitEnv() {
+  if (process.env.GIT_SSH_COMMAND?.trim()) {
+    return {
+      HOME: process.env.HOME ?? "",
+      GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND
+    };
+  }
+  const runtimeRoot = process.env.RIG_RUNTIME_HOME?.trim() || (process.env.RIG_RUNTIME_CONTEXT_FILE?.trim() ? resolve2(process.env.RIG_RUNTIME_CONTEXT_FILE, "..") : inferRuntimeRootFromWorkspace(process.cwd()));
+  const runtimeHome = runtimeRoot ? resolve2(runtimeRoot, "home") : process.env.HOME?.trim() || "";
+  if (!runtimeHome) {
+    return;
+  }
+  const knownHostsPath = resolve2(runtimeHome, ".ssh", "known_hosts");
+  if (!existsSync2(knownHostsPath)) {
+    return { HOME: runtimeHome };
+  }
+  const agentSshKey = resolve2(runtimeHome, ".ssh", "rig-agent-key");
+  const sshParts = [
+    "ssh",
+    `-o UserKnownHostsFile="${knownHostsPath}"`,
+    "-o StrictHostKeyChecking=yes",
+    "-F /dev/null"
+  ];
+  if (existsSync2(agentSshKey)) {
+    sshParts.splice(1, 0, `-i "${agentSshKey}"`, "-o IdentitiesOnly=yes");
+  }
+  return {
+    HOME: runtimeHome,
+    GIT_SSH_COMMAND: sshParts.join(" ")
+  };
+}
+function inferRuntimeRootFromWorkspace(cwd) {
+  const contextPath = findRuntimeContextFile(cwd);
+  if (!contextPath || !existsSync2(contextPath)) {
+    return "";
+  }
+  try {
+    loadRuntimeContext(contextPath);
+    return resolve2(contextPath, "..");
+  } catch {
+    return "";
+  }
+}
+function findRuntimeContextFile(startPath) {
+  let current = resolve2(startPath);
+  while (true) {
+    const candidate = resolve2(current, "runtime-context.json");
+    if (existsSync2(candidate)) {
+      return candidate;
+    }
+    const parent = resolve2(current, "..");
+    if (parent === current) {
+      return "";
+    }
+    current = parent;
+  }
+}
+var ManagedRepoCap, getManagedRepoService = () => getInstalledCapability(ManagedRepoCap), TaskDataCap, taskData = () => requireInstalledCapability(TaskDataCap, "task-data capability unavailable: load @rig/task-sources-plugin (default bundle) before resolving task repos.");
+var init_repo_ops = __esm(() => {
+  ManagedRepoCap = defineCapability2(MANAGED_REPO_SERVICE_CAPABILITY);
+  TaskDataCap = defineCapability2(TASK_DATA_SERVICE_CAPABILITY);
+});
+
+// packages/provider-plugin/src/agent-harness/task-data.ts
+import { TASK_DATA_SERVICE_CAPABILITY as TASK_DATA_SERVICE_CAPABILITY2 } from "@rig/contracts";
+import { defineCapability as defineCapability3 } from "@rig/core/capability";
+import { requireInstalledCapability as requireInstalledCapability2 } from "@rig/core/capability-loaders";
+function taskData2() {
+  return requireInstalledCapability2(TaskDataCap2, "task-data capability unavailable: load @rig/task-sources-plugin (default bundle) before running the provider agent harness.");
+}
+var TaskDataCap2;
+var init_task_data = __esm(() => {
+  TaskDataCap2 = defineCapability3(TASK_DATA_SERVICE_CAPABILITY2);
+});
+
+// packages/provider-plugin/src/agent-harness/task-ops.ts
+function taskArtifactDir(projectRoot, taskId) {
+  return taskData2().taskArtifactDir(projectRoot, taskId);
+}
+function taskArtifacts(projectRoot, taskId) {
+  taskData2().taskArtifacts(projectRoot, taskId);
+}
+function taskArtifactWrite(projectRoot, filename, content, taskId) {
+  taskData2().taskArtifactWrite(projectRoot, filename, content, taskId);
+}
+function taskDeps(projectRoot, taskId) {
+  return taskData2().taskDeps(projectRoot, taskId);
+}
+function taskInfo(projectRoot, taskId) {
+  return taskData2().taskInfo(projectRoot, taskId);
+}
+function taskLookup(projectRoot, id) {
+  return taskData2().taskLookup(projectRoot, id);
+}
+function taskRecord(projectRoot, type, text, taskId) {
+  taskData2().taskRecord(projectRoot, type, text, taskId);
+}
+function taskScope(projectRoot, expandFiles, taskId) {
+  return taskData2().taskScope(projectRoot, expandFiles, taskId);
+}
+function taskStatus(projectRoot) {
+  taskData2().taskStatus(projectRoot);
+}
+function taskValidate(projectRoot, taskId, validatorRegistry) {
+  return taskData2().taskValidate(projectRoot, taskId, validatorRegistry);
+}
+var init_task_ops = __esm(() => {
+  init_task_data();
+});
+
+// packages/provider-plugin/src/agent-harness/rig-agent.ts
+var exports_rig_agent = {};
+__export(exports_rig_agent, {
+  looksLikeShellInvocation: () => looksLikeShellInvocation
+});
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, resolve as resolve3 } from "path";
+import { readBuildConfig } from "@rig/core/build-time-config";
+import { COMPLETION_VERIFICATION_CAPABILITY, MEMORY } from "@rig/contracts";
+import { defineCapability as defineCapability4 } from "@rig/core/capability";
+import { buildProjectPluginHost, loadCapabilityForRoot as loadCapabilityForRoot2 } from "@rig/core/capability-loaders";
+import { resolveCheckoutRoot as resolveMonorepoRoot } from "@rig/core/checkout-root";
+import { browserEnvFromContext, loadRuntimeContext as loadRuntimeContext2, loadRuntimeContextFromEnv } from "@rig/core/runtime-context";
+import { loadDotEnvSecrets, resolveRuntimeSecrets } from "@rig/core/baked-secrets";
+import { RuntimeEventBus } from "@rig/core/runtime-events";
+import {
+  setProfile,
+  setReviewProfile,
+  showProfile,
+  showReviewProfile
+} from "@rig/core/profile-ops";
+function getContext() {
+  if (cachedContext !== undefined)
+    return cachedContext;
+  cachedContext = loadRuntimeContextFromEnv() ?? inferRuntimeContext();
+  return cachedContext;
+}
+function getEventBus() {
+  if (cachedEventBus !== undefined) {
+    return cachedEventBus ?? undefined;
+  }
+  const ctx = getContext();
+  if (!ctx) {
+    cachedEventBus = null;
+    return;
+  }
+  const runId = ctx.runtimeId || BAKED_RUNTIME_ID || "";
+  cachedEventBus = new RuntimeEventBus({
+    projectRoot: ctx.workspaceDir,
+    ...runId ? { runId } : {}
+  });
+  return cachedEventBus;
+}
+function inferRuntimeContext() {
+  for (const candidate of runtimeContextCandidates()) {
+    if (!candidate || !existsSync3(candidate)) {
+      continue;
+    }
+    try {
+      process.env.RIG_RUNTIME_CONTEXT_FILE = candidate;
+      return loadRuntimeContext2(candidate);
+    } catch {}
+  }
+  return null;
+}
+function runtimeContextCandidates() {
+  const cwd = process.cwd();
+  const candidates = [
+    resolve3(cwd, "..", "runtime-context.json"),
+    resolve3(cwd, ".rig", "runtime-context.json")
+  ];
+  const argv1 = process.argv[1]?.trim();
+  if (argv1) {
+    candidates.push(resolve3(argv1, "..", "..", "runtime-context.json"));
+  }
+  if (BAKED_BINARY_PATH) {
+    candidates.push(resolve3(BAKED_BINARY_PATH, "..", "..", "runtime-context.json"));
+  }
+  return Array.from(new Set(candidates));
+}
+function sha256Hex(input) {
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(input);
+  return hasher.digest("hex");
+}
+function ensureRuntimeKnownHosts(runtimeHome) {
+  const sshDir = resolve3(runtimeHome, ".ssh");
+  const knownHostsPath = resolve3(sshDir, "known_hosts");
+  if (!existsSync3(sshDir)) {
+    mkdirSync2(sshDir, { recursive: true });
+  }
+  const existing = existsSync3(knownHostsPath) ? readFileSync2(knownHostsPath, "utf-8") : "";
+  const existingLines = new Set(existing.split(/\r?\n/).map((line) => line.trim()).filter(Boolean));
+  const missing = GITHUB_KNOWN_HOSTS.filter((line) => !existingLines.has(line));
+  if (missing.length === 0) {
+    return knownHostsPath;
+  }
+  try {
+    for (const line of missing) {
+      existingLines.add(line);
+    }
+    writeFileSync2(knownHostsPath, `${Array.from(existingLines).join(`
+`)}
+`, { mode: 420 });
+  } catch (err) {
+    const hint = existsSync3(knownHostsPath) ? "" : " \u2014 known_hosts is missing; git SSH operations may fail";
+    console.warn(`[rig-agent] Could not update ${knownHostsPath}: ${err instanceof Error ? err.message : String(err)}${hint}`);
+  }
+  return knownHostsPath;
+}
+function hydrateRuntimeProcessEnv(ctx) {
+  if (!ctx) {
+    return;
+  }
+  const contextFile = process.env.RIG_RUNTIME_CONTEXT_FILE?.trim() || inferRuntimeContextFileFromWorkspace(ctx.workspaceDir);
+  if (!contextFile) {
+    return;
+  }
+  process.env.RIG_RUNTIME_CONTEXT_FILE = contextFile;
+  const runtimeRoot = dirname2(resolve3(contextFile));
+  const runtimeHome = resolve3(runtimeRoot, "home");
+  const runtimeTmp = resolve3(runtimeRoot, "tmp");
+  const runtimeCache = resolve3(runtimeRoot, "cache");
+  const runtimeBin = resolve3(runtimeRoot, "bin");
+  const runtimeWorkspaceBin = resolve3(ctx.workspaceDir, ".rig", "bin");
+  const runtimeTools = resolve3(ctx.workspaceDir, "rig", "tools");
+  if (ctx.hostProjectRoot) {
+    process.env.PROJECT_RIG_ROOT = ctx.hostProjectRoot;
+  }
+  process.env.RIG_TASK_ID = ctx.taskId;
+  process.env.RIG_TASK_WORKSPACE = ctx.workspaceDir;
+  process.env.RIG_STATE_DIR = ctx.stateDir;
+  process.env.RIG_LOGS_DIR = ctx.logsDir;
+  process.env.RIG_SESSION_FILE = ctx.sessionFile;
+  process.env.RIG_RUNTIME_HOME = runtimeRoot;
+  if (!process.env.RIG_HOST_PROJECT_ROOT && ctx.hostProjectRoot) {
+    process.env.RIG_HOST_PROJECT_ROOT = ctx.hostProjectRoot;
+  }
+  for (const [key, value] of Object.entries(browserEnvFromContext(ctx.browser))) {
+    process.env[key] = value;
+  }
+  if (existsSync3(runtimeHome)) {
+    process.env.HOME = runtimeHome;
+  }
+  if (existsSync3(runtimeTmp)) {
+    process.env.TMPDIR = runtimeTmp;
+  }
+  if (existsSync3(runtimeCache)) {
+    process.env.XDG_CACHE_HOME = runtimeCache;
+  }
+  const workspaceSecrets = loadDotEnvSecrets(ctx.workspaceDir, process.env);
+  const hostWorkspaceSecrets = ctx.hostProjectRoot && ctx.hostProjectRoot !== ctx.workspaceDir ? loadDotEnvSecrets(ctx.hostProjectRoot, process.env) : {};
+  const resolvedSecrets = resolveRuntimeSecrets(process.env, {
+    ...hostWorkspaceSecrets,
+    ...workspaceSecrets
+  });
+  for (const [key, value] of Object.entries(resolvedSecrets)) {
+    if (value && !process.env[key]) {
+      process.env[key] = value;
+    }
+  }
+  if (!process.env.GITHUB_TOKEN && process.env.GH_TOKEN) {
+    process.env.GITHUB_TOKEN = process.env.GH_TOKEN;
+  }
+  if (!process.env.GH_TOKEN && process.env.GITHUB_TOKEN) {
+    process.env.GH_TOKEN = process.env.GITHUB_TOKEN;
+  }
+  if (!process.env.GREPTILE_GITHUB_TOKEN && process.env.GITHUB_TOKEN) {
+    process.env.GREPTILE_GITHUB_TOKEN = process.env.GITHUB_TOKEN;
+  }
+  const currentPath = process.env.PATH || "";
+  const pathEntries = currentPath.split(":").filter(Boolean);
+  for (const entry of [runtimeBin, runtimeWorkspaceBin, runtimeTools, "/usr/bin", "/bin", "/usr/sbin", "/sbin"]) {
+    if (existsSync3(entry) && !pathEntries.includes(entry)) {
+      pathEntries.unshift(entry);
+    }
+  }
+  process.env.PATH = pathEntries.join(":");
+  if (!process.env.RIG_GIT_BIN) {
+    const runtimeGit = resolve3(runtimeBin, "git");
+    process.env.RIG_GIT_BIN = existsSync3(runtimeGit) ? runtimeGit : Bun.which("git") || "/usr/bin/git";
+  }
+  const knownHosts = ensureRuntimeKnownHosts(runtimeHome);
+  const agentKey = resolve3(runtimeHome, ".ssh", "rig-agent-key");
+  const sshParts = [
+    "ssh",
+    `-o UserKnownHostsFile="${knownHosts}"`,
+    "-o StrictHostKeyChecking=yes",
+    "-F /dev/null"
+  ];
+  if (existsSync3(agentKey)) {
+    sshParts.splice(1, 0, `-i "${agentKey}"`, "-o IdentitiesOnly=yes");
+  }
+  process.env.GIT_SSH_COMMAND = sshParts.join(" ");
+}
+function inferRuntimeContextFileFromWorkspace(workspaceDir) {
+  const candidate = resolve3(workspaceDir, "..", "runtime-context.json");
+  return existsSync3(candidate) ? candidate : "";
+}
+async function main() {
+  const args = process.argv.slice(2);
+  hydrateRuntimeProcessEnv(getContext());
+  if (isVersionProbe(args)) {
+    await printVersion();
+    return;
+  }
+  if (args[0] === "internal") {
+    await runInternal(args.slice(1));
+    return;
+  }
+  const ctx = getContext();
+  if (!BAKED_PROJECT_ROOT && !ctx) {
+    console.error("[rig-agent] Runtime binary is missing baked task context and no runtime context file found.");
+    console.error("[rig-agent] Set RIG_RUNTIME_CONTEXT_FILE or use the compiled host dispatch binary.");
+    process.exit(1);
+  }
+  await verifyRuntimeManifest();
+  const commandResult = await runAgentCommand(args);
+  if (commandResult !== undefined) {
+    process.exit(commandResult);
+  }
+  if (looksLikeShellInvocation(args)) {
+    const code = await runControlledBash(args, { projectRootFallbackDir: import.meta.dir });
+    process.exit(code);
+  }
+  console.error(`[rig-agent] Unknown command: ${args[0] || "(none)"}. Run 'rig-agent help' for usage.`);
+  process.exit(1);
+}
+function isVersionProbe(args) {
+  if (args.length !== 1) {
+    return false;
+  }
+  return args[0] === "--version" || args[0] === "-v" || args[0] === "version";
+}
+async function printVersion() {
+  const probe = await Bun.$`claude --version`.cwd(process.cwd()).env(process.env).quiet().nothrow();
+  if (probe.exitCode === 0) {
+    const output = probe.stdout.toString().trim();
+    if (output) {
+      console.log(output);
+      return;
+    }
+  }
+  console.log("rig-agent 1.0.0");
+}
+async function runAgentCommand(args) {
+  const [command, ...rest] = args;
+  if (!command || !TASK_COMMANDS.has(command)) {
+    return;
+  }
+  const ctx = getContext();
+  const projectRoot = ctx?.workspaceDir || BAKED_PROJECT_ROOT || "";
+  const taskId = ctx?.taskId || BAKED_TASK_ID || "";
+  if (!projectRoot) {
+    console.error("[rig-agent] No project root baked in.");
+    return 1;
+  }
+  if (!taskId) {
+    console.error("[rig-agent] No task ID baked in.");
+    return 1;
+  }
+  try {
+    switch (command) {
+      case "info":
+        await taskInfo(projectRoot, taskId);
+        return 0;
+      case "scope":
+        await taskScope(projectRoot, rest.includes("--files"), taskId);
+        return 0;
+      case "deps":
+        await taskDeps(projectRoot, taskId);
+        return 0;
+      case "status":
+        taskStatus(projectRoot);
+        return 0;
+      case "artifacts":
+        taskArtifacts(projectRoot, taskId);
+        return 0;
+      case "artifact-dir":
+        console.log(taskArtifactDir(projectRoot, taskId));
+        return 0;
+      case "project-root":
+        console.log(projectRoot);
+        return 0;
+      case "monorepo-root":
+        console.log(resolveMonorepoRoot(projectRoot));
+        return 0;
+      case "artifact-write": {
+        const filename = rest[0];
+        if (!filename) {
+          console.error(`Usage: rig-agent artifact-write <filename> [--file <path>]
+` + `  Reads content from stdin (or --file), writes to the active task artifact dir.
+` + "  Example: echo '...' | rig-agent artifact-write collection-audit.md");
+          return 1;
+        }
+        let content;
+        const fileIdx = rest.indexOf("--file");
+        const inputFile = fileIdx !== -1 ? rest[fileIdx + 1] : undefined;
+        if (inputFile) {
+          content = readFileSync2(resolve3(projectRoot, inputFile), "utf-8");
+        } else {
+          const chunks = [];
+          for await (const chunk of process.stdin) {
+            chunks.push(Buffer.from(chunk));
+          }
+          content = Buffer.concat(chunks).toString("utf-8");
+        }
+        taskArtifactWrite(projectRoot, filename, content, taskId);
+        return 0;
+      }
+      case "validate": {
+        const passed = await taskValidate(projectRoot, taskId);
+        return passed ? 0 : 1;
+      }
+      case "completion-verification":
+      case "completition-verification":
+        return await runCompletionVerification(projectRoot);
+      case "lookup": {
+        if (rest.length !== 1) {
+          console.error("Usage: rig-agent lookup <beads-id>");
+          return 1;
+        }
+        const lookupId = rest[0];
+        if (!lookupId) {
+          console.error("Usage: rig-agent lookup <beads-id>");
+          return 1;
+        }
+        console.log(taskLookup(projectRoot, lookupId));
+        return 0;
+      }
+      case "record": {
+        if (rest.length < 2) {
+          console.error("Usage: rig-agent record <decision|failure> <text>");
+          return 1;
+        }
+        const type = rest[0];
+        if (type !== "decision" && type !== "failure") {
+          console.error("Usage: rig-agent record <decision|failure> <text>");
+          return 1;
+        }
+        taskRecord(projectRoot, type, rest.slice(1).join(" "), taskId);
+        return 0;
+      }
+      case "memory": {
+        const memoryService = await loadCapabilityForRoot2(projectRoot, defineCapability4(MEMORY));
+        if (!memoryService) {
+          console.error("[rig-agent] Shared memory requires the @rig/memory-plugin plugin in rig.config.");
+          return 1;
+        }
+        const eventBus = getEventBus();
+        console.log(await memoryService.executeMemoryCommand({
+          projectRoot,
+          taskId,
+          runtimeContext: ctx,
+          args: rest,
+          ...eventBus ? { eventBus } : {}
+        }));
+        return 0;
+      }
+      case "git":
+        await runGitCommand(projectRoot, taskId, rest);
+        return 0;
+      case "repo":
+      case "repo-sync":
+        runRepoSyncCommand(projectRoot, taskId, rest);
+        return 0;
+      case "profile":
+        runProfileCommand(projectRoot, rest);
+        return 0;
+      case "review":
+        runReviewCommand(projectRoot, rest);
+        return 0;
+      case "help":
+        printAgentHelp();
+        return 0;
+      default:
+        return;
+    }
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    return 1;
+  }
+}
+async function runGitCommand(projectRoot, bakedTaskId, args) {
+  const [sub = "status", ...rest] = args;
+  const task = takeOption(rest, "--task");
+  const tid = task.value || bakedTaskId;
+  const flags = task.rest;
+  const git = await loadLifecycleGit(projectRoot);
+  switch (sub) {
+    case "status":
+      git.gitStatus(projectRoot, tid);
+      return;
+    case "changed": {
+      const scoped = flags.includes("--scoped");
+      const files = git.gitChanged(projectRoot, tid, scoped);
+      console.log(files.length > 0 ? files.join(`
+`) : "(none)");
+      return;
+    }
+    case "preflight": {
+      const strict = flags.includes("--strict");
+      const ok = git.gitPreflight(projectRoot, tid, strict);
+      if (!ok)
+        throw new Error("Git preflight failed.");
+      return;
+    }
+    case "sync-branch":
+    case "ensure-branch":
+      git.gitSyncBranch(projectRoot, tid);
+      return;
+    case "commit": {
+      const target = takeOption(flags, "--target");
+      const message = takeOption(target.rest, "--message");
+      const allowEmpty = message.rest.includes("--allow-empty");
+      const scoped = git.shouldScopeGitCommit(message.rest, Boolean(tid));
+      git.gitCommit({
+        projectRoot,
+        taskId: tid,
+        target: target.value || "monorepo",
+        allowEmpty,
+        scoped,
+        ...message.value ? { message: message.value } : {}
+      });
+      return;
+    }
+    case "snapshot": {
+      const output = takeOption(flags, "--output");
+      const file = git.gitSnapshot(projectRoot, tid, output.value);
+      console.log(`Snapshot written: ${file}`);
+      return;
+    }
+    case "open-pr": {
+      const target = takeOption(flags, "--target");
+      const reviewer = takeOption(target.rest, "--reviewer");
+      const base = takeOption(reviewer.rest, "--base");
+      const title = takeOption(base.rest, "--title");
+      const body = takeOption(title.rest, "--body");
+      const draft = body.rest.includes("--draft");
+      const result = git.gitOpenPr({
+        projectRoot,
+        taskId: tid,
+        ...target.value ? { target: target.value } : {},
+        ...reviewer.value ? { reviewer: reviewer.value } : {},
+        ...base.value ? { base: base.value } : {},
+        ...title.value ? { title: title.value } : {},
+        ...body.value ? { body: body.value } : {},
+        draft
+      });
+      console.log(`PR ready (${result.repoLabel}): ${result.url}`);
+      console.log(`Reviewer assigned: ${result.reviewer} (${result.reviewerSource})`);
+      return;
+    }
+    default:
+      throw new Error(`Unknown git subcommand: ${sub}. Try: status, changed, preflight, sync-branch, commit, snapshot, open-pr`);
+  }
+}
+function runRepoSyncCommand(projectRoot, bakedTaskId, args) {
+  const [sub = "ensure", ...rest] = args;
+  const task = takeOption(rest, "--task");
+  const tid = task.value || bakedTaskId;
+  switch (sub) {
+    case "sync":
+    case "ensure":
+      repoEnsure(projectRoot, tid);
+      return;
+    case "pins": {
+      const pins = repoPins(projectRoot, tid);
+      printPins(pins);
+      return;
+    }
+    case "verify": {
+      const ok = repoVerify(projectRoot, tid);
+      if (!ok)
+        throw new Error("Repo pin verification failed.");
+      return;
+    }
+    case "discover": {
+      const pins = repoDiscover(projectRoot, tid);
+      printPins(pins);
+      return;
+    }
+    case "baseline": {
+      const refresh = task.rest.includes("--refresh");
+      const pins = repoBaseline(projectRoot, refresh);
+      printPins(pins);
+      return;
+    }
+    default:
+      throw new Error(`Unknown repo subcommand: ${sub}. Try: sync, ensure, pins, verify, discover, baseline`);
+  }
+}
+function runProfileCommand(projectRoot, args) {
+  const [sub = "show", ...rest] = args;
+  if (sub === "show") {
+    showProfile(projectRoot, rest.includes("--compact"));
+    return;
+  }
+  if (sub === "set") {
+    const first = rest[0];
+    if (first === "claude-code" || first === "codex-cli" || first === "codex-app-server") {
+      setProfile(projectRoot, { preset: first });
+      return;
+    }
+    const model = takeOption(rest, "--model");
+    const runtime = takeOption(model.rest, "--runtime");
+    const plugin = takeOption(runtime.rest, "--plugin");
+    setProfile(projectRoot, {
+      ...model.value ? { model: model.value } : {},
+      ...runtime.value ? { runtime: runtime.value } : {},
+      ...plugin.value ? { plugin: plugin.value } : {}
+    });
+    return;
+  }
+  throw new Error(`Unknown profile subcommand: ${sub}. Try: show, set`);
+}
+function runReviewCommand(projectRoot, args) {
+  const [sub = "show", ...rest] = args;
+  if (sub === "show") {
+    showReviewProfile(projectRoot);
+    return;
+  }
+  if (sub === "set") {
+    const mode = rest[0];
+    if (!mode) {
+      throw new Error("Usage: rig-agent review set <off|advisory|required> [--provider github|greptile]");
+    }
+    const provider = takeOption(rest.slice(1), "--provider");
+    setReviewProfile(projectRoot, mode, provider.value);
+    return;
+  }
+  throw new Error(`Unknown review subcommand: ${sub}. Try: show, set`);
+}
+function takeOption(args, option) {
+  const rest = [];
+  let value;
+  for (let i = 0;i < args.length; i += 1) {
+    const current = args[i];
+    if (current === option) {
+      const next = args[i + 1];
+      if (!next || next.startsWith("-")) {
+        throw new Error(`Missing value for ${option}`);
+      }
+      value = next;
+      i += 1;
+      continue;
+    }
+    if (current !== undefined) {
+      rest.push(current);
+    }
+  }
+  return { value, rest };
+}
+function printPins(pins) {
+  if (Object.keys(pins).length === 0) {
+    console.log("(none)");
+    return;
+  }
+  for (const [key, value] of Object.entries(pins)) {
+    console.log(`${key}	${value}`);
+  }
+}
+function printAgentHelp() {
+  console.log(`rig-agent \u2014 CLI for Project Rig agents
+
+ORIENTATION:
+  rig-agent info              Your task, role, scope, deps \u2014 start here
+  rig-agent scope [--files]   Scope globs; --files expands to file list
+  rig-agent deps              Read dependency artifacts (decisions, next-actions)
+  rig-agent lookup <id>       Validate a beads task ID
+  rig-agent status            Epic/task progress overview
+
+EXECUTION:
+  rig-agent validate          Run validation commands for your task
+  rig-agent record decision "..."  Record an architectural decision
+  rig-agent record failure "..."   Record a failed approach (cross-session only \u2014 not re-read in this session)
+  rig-agent memory observe ...     Promote a shared memory immediately
+  rig-agent memory recall [query]  Recall relevant shared memories
+  rig-agent git status        Task-aware git status
+  rig-agent git changed       Changed files (--scoped for scope-filtered)
+  rig-agent git commit        Task-aware commit (--target monorepo|project|both)
+  rig-agent git snapshot      Capture worktree state
+  rig-agent git sync-branch   Ensure task branch exists
+  rig-agent git open-pr       Create PR for task changes
+  rig-agent repo sync         Ensure monorepo checkout + task repo pins
+  rig-agent profile show      Show runtime profile
+  rig-agent review show       Show AI review gate settings
+
+COMPLETION:
+  rig-agent artifacts                   Scaffold completion artifacts (templates)
+  rig-agent artifact-dir                Print absolute artifact directory path
+  rig-agent project-root                Print absolute task worktree root
+  rig-agent monorepo-root               Print absolute monorepo root in the task worktree
+  rig-agent artifact-write <filename>   Write artifact from stdin
+  rig-agent completion-verification     Run final validation/review gate
+  rig-agent completition-verification   Alias for the same final gate
+
+WORKFLOW:
+  1. rig-agent info            Understand your assignment
+  2. rig-agent deps            Read what prior tasks decided
+  3. rig-agent repo sync         Align monorepo checkout + repo pins
+  4. (do your work)
+  5. rig-agent record decision "chose X because Y"
+  6. rig-agent validate        Check your work
+  7. rig-agent artifacts       Scaffold completion artifacts
+  8. rig-agent artifact-write collection-audit.md  (write custom artifacts)
+  9. rig-agent completion-verification
+`);
+}
+async function runCompletionVerification(projectRoot) {
+  const host = await buildProjectPluginHost(projectRoot);
+  const run = host ? await defineCapability4(COMPLETION_VERIFICATION_CAPABILITY).resolve(host) : null;
+  if (!run) {
+    console.error("[rig-agent] Completion verification requires the @rig/bundle-default-lifecycle plugin in rig.config.");
+    return 1;
+  }
+  const { ok } = await run({ projectRoot });
+  return ok ? 0 : 1;
+}
+async function runInternal(args) {
+  const [command = "", ...rest] = args;
+  if (command === "shell") {
+    const code = await runControlledBash(rest, { projectRootFallbackDir: import.meta.dir });
+    process.exit(code);
+  }
+  if (command === "manifest-verify") {
+    await verifyRuntimeManifest();
+    console.log("manifest: ok");
+    return;
+  }
+  throw new Error("Unknown internal command. Use `rig-agent internal shell <bash-args...>` or `rig-agent internal manifest-verify`.");
+}
+async function verifyRuntimeManifest() {
+  if (getContext()) {
+    return;
+  }
+  const manifestPath = BAKED_MANIFEST_PATH;
+  if (!manifestPath) {
+    return;
+  }
+  if (!existsSync3(manifestPath)) {
+    throw new Error(`[rig-agent] Runtime manifest missing: ${manifestPath}`);
+  }
+  let manifest;
+  try {
+    manifest = await Bun.file(manifestPath).json();
+  } catch (error) {
+    throw new Error(`[rig-agent] Failed to parse runtime manifest at ${manifestPath}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  assertMatch("taskId", BAKED_TASK_ID, manifest.taskId);
+  assertMatch("runtimeId", BAKED_RUNTIME_ID, manifest.runtimeId);
+  assertMatch("scopeHash", BAKED_SCOPE_HASH, manifest.scopeHash);
+  const manifestBinaryPath = manifest.binary?.path || BAKED_BINARY_PATH || process.execPath;
+  const expectedHash = manifest.binary?.sha256 || "";
+  if (!manifestBinaryPath || !expectedHash) {
+    throw new Error(`[rig-agent] Runtime manifest is missing binary hash data (${manifestPath}).`);
+  }
+  if (!existsSync3(manifestBinaryPath)) {
+    throw new Error(`[rig-agent] Runtime binary not found at ${manifestBinaryPath}.`);
+  }
+  const actualHash = sha256Hex(readFileSync2(resolve3(manifestBinaryPath)));
+  if (actualHash !== expectedHash) {
+    throw new Error(`[rig-agent] Runtime manifest mismatch for binary hash.
+` + `expected=${expectedHash}
+` + `actual=${actualHash}
+` + `path=${manifestBinaryPath}`);
+  }
+}
+function assertMatch(name, expected, actual) {
+  if (!expected && !actual) {
+    return;
+  }
+  if (expected !== (actual || "")) {
+    throw new Error(`[rig-agent] Runtime manifest mismatch for ${name}: expected='${expected}' actual='${actual || ""}'.`);
+  }
+}
+var BUILD_CONFIG, BAKED_BINARY_PATH, BAKED_MANIFEST_PATH, BAKED_PROJECT_ROOT, BAKED_RUNTIME_ID, BAKED_TASK_ID, BAKED_SCOPE_HASH, BAKED_INFO_OUTPUT, BAKED_DEPS_OUTPUT, BAKED_STATUS_OUTPUT, BAKED_GIT_BRANCH, BAKED_BASE_COMMIT, cachedContext, cachedEventBus, GITHUB_KNOWN_HOSTS, TASK_COMMANDS;
+var init_rig_agent = __esm(() => {
+  init_controlled_bash();
+  init_git_ops();
+  init_repo_ops();
+  init_task_ops();
+  BUILD_CONFIG = readBuildConfig();
+  BAKED_BINARY_PATH = BUILD_CONFIG.AGENT_BINARY_PATH ?? "";
+  BAKED_MANIFEST_PATH = BUILD_CONFIG.AGENT_MANIFEST_PATH ?? "";
+  BAKED_PROJECT_ROOT = BUILD_CONFIG.AGENT_PROJECT_ROOT ?? "";
+  BAKED_RUNTIME_ID = BUILD_CONFIG.AGENT_RUNTIME_ID ?? "";
+  BAKED_TASK_ID = BUILD_CONFIG.AGENT_TASK_ID ?? "";
+  BAKED_SCOPE_HASH = BUILD_CONFIG.AGENT_SCOPE_HASH ?? "";
+  BAKED_INFO_OUTPUT = BUILD_CONFIG.AGENT_INFO_OUTPUT ?? "";
+  BAKED_DEPS_OUTPUT = BUILD_CONFIG.AGENT_DEPS_OUTPUT ?? "";
+  BAKED_STATUS_OUTPUT = BUILD_CONFIG.AGENT_STATUS_OUTPUT ?? "";
+  BAKED_GIT_BRANCH = BUILD_CONFIG.AGENT_GIT_BRANCH ?? "";
+  BAKED_BASE_COMMIT = BUILD_CONFIG.AGENT_BASE_COMMIT ?? "";
+  if (BAKED_BINARY_PATH) {
+    const binaryDir = dirname2(BAKED_BINARY_PATH);
+    const currentPath = process.env.PATH || "";
+    const pathEntries = currentPath.split(":").filter(Boolean);
+    if (!pathEntries.includes(binaryDir)) {
+      process.env.PATH = currentPath ? `${binaryDir}:${currentPath}` : binaryDir;
+    }
+  }
+  GITHUB_KNOWN_HOSTS = [
+    "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl",
+    "github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=",
+    "github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk="
+  ];
+  TASK_COMMANDS = new Set([
+    "info",
+    "scope",
+    "deps",
+    "status",
+    "artifacts",
+    "artifact-dir",
+    "artifact-write",
+    "project-root",
+    "monorepo-root",
+    "validate",
+    "lookup",
+    "record",
+    "help",
+    "completion-verification",
+    "completition-verification",
+    "git",
+    "repo",
+    "repo-sync",
+    "profile",
+    "review",
+    "memory"
+  ]);
+  main().catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  });
+});
+
+// packages/provider-plugin/src/agent-harness/rig-agent-entrypoint.ts
+var exports_rig_agent_entrypoint = {};
+__export(exports_rig_agent_entrypoint, {
+  runRigAgentEntrypoint: () => runRigAgentEntrypoint
+});
+import { adopt } from "@rig/core/kernel-entrypoint";
+async function runRigAgentEntrypoint() {
+  await adopt(undefined, { entrypoint: "rig-agent" });
+  await Promise.resolve().then(() => (init_rig_agent(), exports_rig_agent));
+}
+var init_rig_agent_entrypoint = () => {};
+
+// packages/provider-plugin/src/agent-harness/runtime-snapshot-config.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { resolve as resolve4 } from "path";
+function loadRuntimeSnapshotConfig(projectRoot) {
+  const configPath = resolve4(projectRoot, "rig/policy/policy.json");
+  if (!existsSync4(configPath))
+    return { ...DEFAULT_RUNTIME_SNAPSHOT };
+  try {
+    const parsed = JSON.parse(readFileSync3(configPath, "utf8"));
+    const runtimeSnapshot = parsed.runtime_snapshot;
+    if (runtimeSnapshot && typeof runtimeSnapshot === "object" && !Array.isArray(runtimeSnapshot)) {
+      const enabled = runtimeSnapshot.enabled;
+      if (typeof enabled === "boolean")
+        return { enabled };
+    }
+  } catch {
+    return { ...DEFAULT_RUNTIME_SNAPSHOT };
+  }
+  return { ...DEFAULT_RUNTIME_SNAPSHOT };
+}
+var DEFAULT_RUNTIME_SNAPSHOT;
+var init_runtime_snapshot_config = __esm(() => {
+  DEFAULT_RUNTIME_SNAPSHOT = { enabled: true };
+});
+
+// packages/provider-plugin/src/agent-harness/agent-wrapper.ts
+var exports_agent_wrapper = {};
+__export(exports_agent_wrapper, {
+  updateTaskSourceAfterRun: () => updateTaskSourceAfterRun,
+  startOptionalRuntimeSnapshotSidecar: () => startOptionalRuntimeSnapshotSidecar,
+  shouldBypassProviderSandboxOnPlatform: () => shouldBypassProviderSandboxOnPlatform,
+  runPiRpcProviderFallback: () => runPiRpcProviderFallback,
+  runPiRpcProvider: () => runPiRpcProvider,
+  runAgentWrapper: () => runAgentWrapper,
+  resolveTaskFromBeads: () => resolveTaskFromBeads,
+  resolveRuntimeHandoffPath: () => resolveRuntimeHandoffPath,
+  resolveProvider: () => resolveProvider,
+  resolveFinalProviderExitCode: () => resolveFinalProviderExitCode,
+  recordSnapshotMissingTaskSourceEvidence: () => recordSnapshotMissingTaskSourceEvidence,
+  recordRuntimeHandoff: () => recordRuntimeHandoff,
+  isTaskClosed: () => isTaskClosed,
+  finalizeRuntimeSnapshot: () => finalizeRuntimeSnapshot,
+  buildProviderArgs: () => buildProviderArgs
+});
+import { createRequire } from "module";
+import { resolve as resolve5 } from "path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
+import { assertPathInsideRoot, safePathSegment, taskRuntimeId } from "@rig/core/safe-identifiers";
+import {
+  ISOLATION_BACKEND,
+  TASK_DATA_SERVICE_CAPABILITY as TASK_DATA_SERVICE_CAPABILITY3
+} from "@rig/contracts";
+import { defineCapability as defineCapability5 } from "@rig/core/capability";
+import { requireCapabilityForRoot } from "@rig/core/capability-loaders";
+import { loadRuntimeContextFromEnv as loadRuntimeContextFromEnv2 } from "@rig/core/runtime-context";
+import { resolveCheckoutRoot as resolveMonorepoRoot2 } from "@rig/core/checkout-root";
+import { buildPluginHostContext as buildPluginHostContext2 } from "@rig/core/plugin-host-context";
+function resolveTaskDataService(projectRoot) {
+  let cached = taskDataServiceByRoot.get(projectRoot);
+  if (!cached) {
+    cached = requireCapabilityForRoot(projectRoot, defineCapability5(TASK_DATA_SERVICE_CAPABILITY3), `No TASK_DATA_SERVICE capability is registered for project root "${projectRoot}". ` + "Install @rig/task-sources-plugin (it ships in the default bundle) so the agent " + "executor can resolve task-state reads and lifecycle updates.");
+    taskDataServiceByRoot.set(projectRoot, cached);
+  }
+  return cached;
+}
+async function finalizeRuntimeSnapshot(snapshotSidecar, providerCommand, exitCode, context) {
+  try {
+    await snapshotSidecar.finalize(providerCommand, exitCode);
+    return { ok: true };
+  } catch (error) {
+    emitWrapperEvent("runtime.snapshot.finalize.failed", {
+      runtimeId: context.runtimeId,
+      taskId: context.taskId,
+      exitCode,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    console.error(`[rig-agent] Snapshot finalize failed for ${context.taskId}: ${error instanceof Error ? error.message : String(error)}`);
+    if (exitCode !== 0) {
+      throw error;
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    return { ok: false, snapshotMissing: true, error: message };
+  }
+}
+async function startOptionalRuntimeSnapshotSidecar(runtime, startSidecar) {
+  try {
+    return await startSidecar(runtime, { instanceId: `${runtime.id}-wrapper` });
+  } catch (error) {
+    emitWrapperEvent("runtime.snapshot.start.failed", {
+      runtimeId: runtime.id,
+      taskId: runtime.taskId,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    console.error(`[rig-agent] Runtime snapshotting unavailable for ${runtime.taskId}: ${error instanceof Error ? error.message : String(error)}`);
+    return null;
+  }
+}
+async function runAgentWrapper(options = {}) {
+  const projectRoot = resolve5(options.projectRoot || process.env.PROJECT_RIG_ROOT || process.cwd());
+  const monorepoRoot = resolveMonorepoRoot2(projectRoot);
+  const argv = options.argv || process.argv.slice(2);
+  if (argv.length === 0 || argv[0] === "--version" || argv[0] === "--help" || argv[0] === "help") {
+    console.log("[rig-agent] dispatch ready");
+    return 0;
+  }
+  const taskId = await resolveTaskId(projectRoot, monorepoRoot);
+  if (!taskId) {
+    console.error("[rig-agent] No active task ID found (checked env, session, beads).");
+    console.error("[rig-agent] Refusing to run unsandboxed. Ensure task runtime/session injection is active.");
+    return 1;
+  }
+  const provider = resolveProvider();
+  await printTaskContext(monorepoRoot, taskId);
+  let runtime;
+  let isolationBackend;
+  try {
+    emitWrapperEvent("runtime.provision.started", {
+      projectRoot,
+      taskId,
+      mode: "worktree"
+    });
+    isolationBackend = await requireCapabilityForRoot(projectRoot, defineCapability5(ISOLATION_BACKEND), `No ISOLATION_BACKEND capability is registered for project root "${projectRoot}". ` + "Install @rig/isolation-plugin (it ships in the default bundle) so runtime provisioning can resolve a backend.");
+    const taskRecordReader = taskRecordReaderFromEnv(taskId);
+    runtime = await isolationBackend.ensureAgentRuntime({
+      projectRoot,
+      id: taskRuntimeId(taskId),
+      taskId,
+      mode: "worktree",
+      provider,
+      ...taskRecordReader ? { taskRecordReader } : {},
+      preserveTaskArtifacts: process.env.RIG_RUN_RESUME === "1" || process.env.RIG_RUNTIME_ARTIFACT_CLEANUP === "preserve"
+    });
+    emitWrapperEvent("runtime.provision.completed", {
+      runtimeId: runtime.id,
+      taskId,
+      workspaceDir: runtime.workspaceDir,
+      sessionDir: runtime.sessionDir,
+      logsDir: runtime.logsDir,
+      stateDir: runtime.stateDir,
+      contextFile: runtime.contextFile,
+      snapshotManaged: true
+    });
+  } catch (error) {
+    emitWrapperEvent("runtime.provision.failed", {
+      taskId,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    console.error(`[rig-agent] Failed to provision runtime: ${error}`);
+    return 1;
+  }
+  try {
+    await waitForDirtyBaselineReady(runtime, taskId);
+  } catch (error) {
+    emitWrapperEvent("runtime.baseline.failed", {
+      runtimeId: runtime.id,
+      taskId,
+      workspaceDir: runtime.workspaceDir,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    console.error(`[rig-agent] Failed to apply selected baseline before provider launch: ${error}`);
+    return 1;
+  }
+  const providerArgs = buildProviderArgs(provider, runtime, argv);
+  const providerCommand = [providerBinary(provider), ...providerArgs];
+  emitWrapperEvent("provider.launch", {
+    provider,
+    runtimeId: runtime.id,
+    taskId,
+    workspaceDir: runtime.workspaceDir,
+    command: providerCommand
+  });
+  const env = await isolationBackend.runtimeEnv(projectRoot, runtime);
+  const bypassOuterRuntimeSandbox = shouldBypassProviderSandboxOnPlatform(provider, process.platform);
+  if (provider === "pi") {
+    env.PI_CODING_AGENT_DIR = resolve5(runtime.homeDir, ".pi", "agent");
+    env.PI_CODING_AGENT_SESSION_DIR = runtime.sessionDir;
+  }
+  env.RIG_RUNTIME_SANDBOX = process.env.RIG_RUNTIME_SANDBOX?.trim() || "enforce";
+  const snapshotEnabled = loadRuntimeSnapshotConfig(projectRoot).enabled;
+  const snapshotSidecar = snapshotEnabled ? await startOptionalRuntimeSnapshotSidecar(runtime, (rt, opts) => isolationBackend.startRuntimeSnapshotSidecar(rt, opts)) : null;
+  let exitCode = 1;
+  let snapshotFinalizeResult = { ok: true };
+  try {
+    const command = bypassOuterRuntimeSandbox ? providerCommand : (await isolationBackend.wrapRuntimeSandbox({
+      projectRoot,
+      runtime: {
+        id: runtime.id,
+        mode: runtime.mode,
+        rootDir: runtime.rootDir,
+        workspaceDir: runtime.workspaceDir,
+        binDir: runtime.binDir,
+        homeDir: runtime.homeDir,
+        tmpDir: runtime.tmpDir,
+        cacheDir: runtime.cacheDir,
+        stateDir: runtime.stateDir,
+        sessionDir: runtime.sessionDir,
+        claudeHomeDir: runtime.claudeHomeDir
+      },
+      command: providerCommand
+    })).command;
+    if (isPiRpcArgs(providerArgs)) {
+      const prompt = await readProcessStdin();
+      const runId = process.env.RIG_SERVER_RUN_ID?.trim();
+      exitCode = await runPiRpcProviderFallback({
+        command,
+        cwd: runtime.workspaceDir,
+        env,
+        prompt,
+        ...runId ? { runId } : {},
+        sessionName: runId ? `Rig ${runId}` : `Rig ${runtime.taskId}`
+      });
+    } else {
+      const proc = Bun.spawn(command, {
+        cwd: runtime.workspaceDir,
+        env,
+        stdin: "inherit",
+        stdout: "inherit",
+        stderr: "inherit"
+      });
+      exitCode = await proc.exited;
+    }
+    if (snapshotSidecar) {
+      snapshotFinalizeResult = await finalizeRuntimeSnapshot(snapshotSidecar, providerCommand, exitCode, {
+        runtimeId: runtime.id,
+        taskId
+      });
+    }
+  } catch (error) {
+    if (snapshotSidecar) {
+      await snapshotSidecar.cancel();
+    }
+    throw error;
+  }
+  const serverManagedRun = Boolean(process.env.RIG_SERVER_RUN_ID?.trim());
+  const taskClosed = await isTaskClosed(monorepoRoot, taskId);
+  const finalExitCode = resolveFinalProviderExitCode({
+    providerExitCode: exitCode,
+    taskClosed,
+    serverManagedRun
+  });
+  const snapshotMissing = !snapshotFinalizeResult.ok;
+  const handoffRequired = exitCode !== 0 || snapshotMissing || !taskClosed && !serverManagedRun;
+  emitWrapperEvent("provider.completed", {
+    provider,
+    runtimeId: runtime.id,
+    taskId,
+    exitCode: finalExitCode,
+    providerExitCode: exitCode,
+    taskClosed,
+    serverManagedRun,
+    handoffRequired,
+    snapshotMissing,
+    ...!snapshotFinalizeResult.ok ? { snapshotFinalizeError: snapshotFinalizeResult.error } : {}
+  });
+  if (handoffRequired) {
+    recordRuntimeHandoff(projectRoot, runtime, taskId, exitCode, {
+      snapshotMissing,
+      snapshotFinalizeError: snapshotFinalizeResult.ok ? null : snapshotFinalizeResult.error
+    });
+    if (!snapshotFinalizeResult.ok) {
+      await recordSnapshotMissingTaskSourceEvidence(projectRoot, taskId, runtime, snapshotFinalizeResult.error);
+    }
+  }
+  return finalExitCode;
+}
+function parseJsonRecord(line) {
+  try {
+    const parsed = JSON.parse(line);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function readProcessStdin() {
+  if (process.stdin.isTTY)
+    return "";
+  return await new Promise((resolveRead) => {
+    let data = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      data += String(chunk);
+    });
+    process.stdin.on("end", () => resolveRead(data));
+    process.stdin.resume();
+  });
+}
+async function pumpReadableLines(stream, onLine) {
+  if (!stream)
+    return;
+  const reader = stream.getReader();
+  const decoder = new TextDecoder;
+  let buffer = "";
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      buffer += decoder.decode(value, { stream: true });
+      const parts = buffer.split(/\r?\n/);
+      buffer = parts.pop() ?? "";
+      for (const part of parts)
+        onLine(part);
+    }
+    buffer += decoder.decode();
+    if (buffer)
+      onLine(buffer);
+  } finally {
+    reader.releaseLock();
+  }
+}
+function isBlockingPiRpcUiRequest(record) {
+  if (record.type !== "extension_ui_request")
+    return false;
+  return record.method === "select" || record.method === "confirm" || record.method === "input" || record.method === "editor";
+}
+function writeRpcCommand(stdin, command) {
+  stdin.write(`${JSON.stringify(command)}
+`);
+}
+function joinUrl(baseUrl, pathname) {
+  return `${baseUrl.replace(/\/+$/, "")}${pathname.startsWith("/") ? pathname : `/${pathname}`}`;
+}
+async function readQueuedSteeringFromServer(input) {
+  if (!input.serverUrl || !input.runId)
+    return [];
+  const headers = {};
+  if (input.authToken)
+    headers.authorization = `Bearer ${input.authToken}`;
+  if (input.projectRoot)
+    headers["x-rig-project-root"] = input.projectRoot;
+  const response = await fetch(joinUrl(input.serverUrl, `/api/runs/${encodeURIComponent(input.runId)}/steering?ack=1`), { headers });
+  if (!response.ok) {
+    throw new Error(`steering read rejected (${response.status}) at ${input.serverUrl}`);
+  }
+  const payload = await response.json().catch(() => null);
+  const messages = payload && typeof payload === "object" && !Array.isArray(payload) ? payload.messages : null;
+  return Array.isArray(messages) ? messages.filter((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry))) : [];
+}
+function steeringMessageText(entry) {
+  const message = typeof entry.message === "string" ? entry.message.trim() : "";
+  return message || null;
+}
+function isPiRpcArgs(args) {
+  return cliOptionValue(args, "--mode") === "rpc";
+}
+async function runPiRpcProviderFallback(input) {
+  const stdout = input.stdout ?? process.stdout;
+  const stderr = input.stderr ?? process.stderr;
+  const proc = Bun.spawn(input.command, {
+    cwd: input.cwd,
+    env: input.env,
+    stdin: "pipe",
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  let sawAgentEnd = false;
+  let promptError = null;
+  let stdinOpen = true;
+  let steeringPollStopped = false;
+  const closeStdin = () => {
+    if (!stdinOpen)
+      return;
+    stdinOpen = false;
+    try {
+      steeringPollStopped = true;
+      proc.stdin.end();
+    } catch {}
+  };
+  const send = (command) => {
+    if (!stdinOpen)
+      return;
+    try {
+      writeRpcCommand(proc.stdin, command);
+    } catch (error) {
+      promptError ??= error instanceof Error ? error.message : String(error);
+    }
+  };
+  const forwardSigterm = () => {
+    try {
+      proc.kill("SIGTERM");
+    } catch {}
+  };
+  process.once("SIGTERM", forwardSigterm);
+  const pollSteering = async () => {
+    const serverUrl = input.env.RIG_SERVER_URL || input.env.RIG_SERVER_BASE_URL;
+    const authToken = input.env.RIG_AUTH_TOKEN || input.env.RIG_SERVER_AUTH_TOKEN;
+    const projectRoot = input.env.PROJECT_RIG_ROOT || input.env.RIG_HOST_PROJECT_ROOT || process.env.PROJECT_RIG_ROOT;
+    let lastReportedPollError = null;
+    while (!steeringPollStopped && stdinOpen) {
+      try {
+        const messages = await readQueuedSteeringFromServer({
+          ...serverUrl ? { serverUrl } : {},
+          ...authToken ? { authToken } : {},
+          ...input.runId ? { runId: input.runId } : {},
+          ...projectRoot ? { projectRoot } : {}
+        });
+        lastReportedPollError = null;
+        for (const message of messages) {
+          const text = steeringMessageText(message);
+          if (!text || !stdinOpen)
+            continue;
+          send({
+            id: typeof message.id === "string" ? `rig_steer_${message.id}` : `rig_steer_${Date.now()}`,
+            type: "prompt",
+            message: text,
+            streamingBehavior: "steer"
+          });
+          emitWrapperEvent("pi.rpc.steering.delivered", {
+            runId: input.runId ?? null,
+            steeringId: typeof message.id === "string" ? message.id : null,
+            actor: typeof message.actor === "string" ? message.actor : "operator",
+            message: text
+          });
+        }
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (message !== lastReportedPollError) {
+          lastReportedPollError = message;
+          emitWrapperEvent("pi.rpc.steering.poll.failed", {
+            runId: input.runId ?? null,
+            error: message
+          });
+        }
+      }
+      await sleep(1000);
+    }
+  };
+  const stdoutPump = pumpReadableLines(proc.stdout, (line) => {
+    stdout.write(`${line}
+`);
+    const record = parseJsonRecord(line.trim());
+    if (!record)
+      return;
+    if (record.type === "agent_end") {
+      sawAgentEnd = true;
+      closeStdin();
+      return;
+    }
+    if (record.type === "response" && record.command === "prompt" && record.success === false) {
+      promptError = typeof record.error === "string" ? record.error : "Pi RPC prompt failed.";
+      closeStdin();
+      return;
+    }
+    if (isBlockingPiRpcUiRequest(record)) {
+      const id = typeof record.id === "string" ? record.id : "";
+      if (id) {
+        send({ type: "extension_ui_response", id, cancelled: true });
+        emitWrapperEvent("pi.rpc.extension_ui.cancelled", {
+          id,
+          method: record.method,
+          reason: "noninteractive Rig worker RPC session"
+        });
+      }
+    }
+  });
+  const stderrPump = pumpReadableLines(proc.stderr, (line) => {
+    stderr.write(`${line}
+`);
+  });
+  if (input.sessionName?.trim()) {
+    send({ id: "rig_set_session_name", type: "set_session_name", name: input.sessionName.trim() });
+  }
+  const steeringPollPromise = pollSteering();
+  if (input.prompt.trim()) {
+    send({ id: "rig_initial_prompt", type: "prompt", message: input.prompt });
+    emitWrapperEvent("pi.rpc.prompt.sent", {
+      runId: input.runId ?? null,
+      kind: "initial",
+      bytes: Buffer.byteLength(input.prompt)
+    });
+  } else {
+    closeStdin();
+  }
+  const exitCode = await proc.exited;
+  process.off("SIGTERM", forwardSigterm);
+  steeringPollStopped = true;
+  await Promise.all([stdoutPump, stderrPump, steeringPollPromise]);
+  if (promptError) {
+    stderr.write(`[rig-agent] Pi RPC prompt failed: ${promptError}
+`);
+    return exitCode === 0 ? 1 : exitCode;
+  }
+  if (input.prompt.trim() && !sawAgentEnd && exitCode === 0) {
+    stderr.write(`[rig-agent] Pi RPC exited before emitting agent_end.
+`);
+    return 1;
+  }
+  return exitCode;
+}
+function resolveFinalProviderExitCode(input) {
+  if (input.providerExitCode !== 0) {
+    return input.providerExitCode;
+  }
+  if (input.taskClosed || input.serverManagedRun) {
+    return 0;
+  }
+  return 0;
+}
+function shouldBypassProviderSandboxOnPlatform(provider, platform) {
+  if (platform !== "darwin") {
+    return false;
+  }
+  return provider === "pi";
+}
+function buildProviderArgs(_provider, _runtime, argv) {
+  const piArgs = argv.filter((arg) => arg !== "__rig_pi_session_daemon__");
+  const piProvider = cliOptionValue(piArgs, "--provider") || process.env.RIG_PI_PROVIDER?.trim() || "openai-codex";
+  if (!hasCliOption(piArgs, "--provider")) {
+    piArgs.unshift(piProvider);
+    piArgs.unshift("--provider");
+  }
+  const model = cliOptionValue(piArgs, "--model") || process.env.RIG_PI_MODEL?.trim() || "gpt-5.5";
+  if (hasCliOption(piArgs, "--model")) {
+    rewriteCliOptionValue(piArgs, "--model", normalizePiModelForProvider(model, piProvider));
+  } else {
+    piArgs.unshift(normalizePiModelForProvider(model, piProvider));
+    piArgs.unshift("--model");
+  }
+  if (!hasCliOption(piArgs, "--mode")) {
+    piArgs.push("--mode", process.env.RIG_PI_TRANSPORT?.trim() === "print" ? "json" : "rpc");
+    if (process.env.RIG_PI_TRANSPORT?.trim() === "print" && !hasCliOption(piArgs, "--print")) {
+      piArgs.push("--print");
+    }
+  }
+  return piArgs;
+}
+function taskRecordReaderFromEnv(taskId) {
+  const raw = process.env.RIG_SOURCE_TASK_JSON?.trim();
+  if (!raw) {
+    return;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return;
+    }
+    const task = parsed;
+    if (typeof task.id !== "string" || task.id !== taskId) {
+      return;
+    }
+    return {
+      async listTasks() {
+        return [task];
+      },
+      async getTask(id) {
+        return id === task.id ? task : null;
+      }
+    };
+  } catch {
+    return;
+  }
+}
+async function runBeadsJson(projectRoot, args) {
+  const output = await Bun.$`br --no-db ${args} --json`.cwd(projectRoot).quiet().nothrow();
+  if (output.exitCode !== 0) {
+    return null;
+  }
+  try {
+    return await output.json();
+  } catch {
+    return null;
+  }
+}
+function resolveProvider() {
+  return "pi";
+}
+function hasCliOption(argv, option) {
+  return argv.some((arg) => arg === option || arg.startsWith(`${option}=`));
+}
+function cliOptionValue(argv, option) {
+  for (let index = 0;index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === option) {
+      const next = argv[index + 1];
+      return next && !next.startsWith("--") ? next : undefined;
+    }
+    if (arg?.startsWith(`${option}=`)) {
+      return arg.slice(option.length + 1);
+    }
+  }
+  return;
+}
+function rewriteCliOptionValue(argv, option, value) {
+  for (let index = 0;index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === option && argv[index + 1] && !argv[index + 1].startsWith("--")) {
+      argv[index + 1] = value;
+      return;
+    }
+    if (arg?.startsWith(`${option}=`)) {
+      argv[index] = `${option}=${value}`;
+      return;
+    }
+  }
+}
+function normalizePiModelForProvider(model, provider) {
+  if (provider === "openrouter" && model === "openai-codex/gpt-5.5") {
+    return "openai/gpt-5.5";
+  }
+  return model;
+}
+function resolveFromShellPath(binary) {
+  const resolved = Bun.spawnSync(["sh", "-lc", `command -v ${binary}`], {
+    stdout: "pipe",
+    stderr: "ignore",
+    stdin: "ignore",
+    env: process.env
+  });
+  if (resolved.exitCode !== 0)
+    return null;
+  const path = resolved.stdout.toString().trim().split(/\r?\n/)[0]?.trim();
+  return path || null;
+}
+function resolveBundledPiBinary() {
+  try {
+    const packageJson = requireFromRuntime.resolve("@oh-my-pi/pi-coding-agent/package.json");
+    const binaryPath = resolve5(packageJson, "..", "dist", "cli.js");
+    return existsSync5(binaryPath) ? binaryPath : null;
+  } catch {
+    return null;
+  }
+}
+function providerBinary(_provider) {
+  return process.env.RIG_PI_BINARY?.trim() || resolveBundledPiBinary() || resolveFromShellPath("pi") || Bun.which("pi") || "pi";
+}
+function emitWrapperEvent(type, payload) {
+  console.log(`__RIG_WRAPPER_EVENT__${JSON.stringify({ type, payload, at: new Date().toISOString() })}`);
+}
+function sleep(ms) {
+  return new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
+}
+async function waitForDirtyBaselineReady(runtime, taskId) {
+  const readyFile = process.env.RIG_DIRTY_BASELINE_READY_FILE?.trim();
+  if (process.env.RIG_BASELINE_MODE !== "dirty-snapshot" || !readyFile)
+    return;
+  const timeoutMs = Number.parseInt(process.env.RIG_DIRTY_BASELINE_TIMEOUT_MS ?? "30000", 10);
+  const deadline = Date.now() + (Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : 30000);
+  emitWrapperEvent("runtime.baseline.waiting", {
+    runtimeId: runtime.id,
+    taskId,
+    workspaceDir: runtime.workspaceDir,
+    readyFile
+  });
+  while (!existsSync5(readyFile)) {
+    if (Date.now() >= deadline) {
+      throw new Error(`Timed out waiting for dirty baseline ready file: ${readyFile}`);
+    }
+    await sleep(50);
+  }
+  emitWrapperEvent("runtime.baseline.completed", {
+    runtimeId: runtime.id,
+    taskId,
+    workspaceDir: runtime.workspaceDir,
+    readyFile
+  });
+}
+async function resolveTaskId(projectRoot, monorepoRoot) {
+  if (process.env.RIG_TASK_ID) {
+    return process.env.RIG_TASK_ID;
+  }
+  const fromState = (await resolveTaskDataService(projectRoot)).currentTaskId(projectRoot);
+  if (fromState) {
+    return fromState;
+  }
+  return resolveTaskFromBeads(monorepoRoot);
+}
+async function resolveTaskFromBeads(projectRoot, readBeadsJson = runBeadsJson) {
+  const inProgress = await readBeadsJson(projectRoot, ["list", "--status", "in_progress"]);
+  if (inProgress) {
+    const task = inProgress.find((t) => t.issue_type === "task");
+    if (task?.id) {
+      return task.id;
+    }
+  }
+  const ready = await readBeadsJson(projectRoot, ["ready"]);
+  if (ready) {
+    const task = ready.find((t) => t.issue_type === "task");
+    if (task?.id) {
+      return task.id;
+    }
+  }
+  return "";
+}
+async function isTaskClosed(projectRoot, taskId, readBeadsJson = runBeadsJson) {
+  const pluginStatus = await readPluginTaskStatus(projectRoot, taskId);
+  if (isTerminalTaskStatus(pluginStatus)) {
+    return true;
+  }
+  const parsed = await readBeadsJson(projectRoot, ["show", taskId]);
+  const record = Array.isArray(parsed) ? parsed[0] : parsed;
+  if (record && typeof record === "object" && !Array.isArray(record)) {
+    return isTerminalTaskStatus(record.status);
+  }
+  return false;
+}
+function isTerminalTaskStatus(status) {
+  return status === "closed" || status === "CLOSED" || status === "completed" || status === "cancelled" || status === "blocked";
+}
+async function readPluginTaskStatus(projectRoot, taskId) {
+  const taskData3 = await resolveTaskDataService(projectRoot);
+  try {
+    const ctx = await buildPluginHostContext2(projectRoot);
+    const [source] = ctx?.taskSourceRegistry.list() ?? [];
+    if (!source?.get) {
+      return taskData3.readSourceAwareTaskStatus(projectRoot, taskId);
+    }
+    return (await source.get(taskId))?.status ?? taskData3.readSourceAwareTaskStatus(projectRoot, taskId);
+  } catch {
+    return taskData3.readSourceAwareTaskStatus(projectRoot, taskId);
+  }
+}
+async function recordSnapshotMissingTaskSourceEvidence(projectRoot, taskId, runtime, snapshotFinalizeError) {
+  const taskData3 = await resolveTaskDataService(projectRoot);
+  const comment = taskData3.buildTaskRunLifecycleComment({
+    runId: process.env.RIG_SERVER_RUN_ID || "(unknown)",
+    status: "snapshot-missing",
+    summary: "Rig runtime completed, but the after-snapshot finalize failed. Closeout evidence is degraded until the runtime workspace is inspected directly.",
+    runtimeWorkspace: runtime.workspaceDir,
+    logsDir: runtime.logsDir,
+    sessionDir: runtime.sessionDir,
+    errorText: snapshotFinalizeError
+  });
+  try {
+    const result = await taskData3.updateConfiguredTaskSourceTask(projectRoot, {
+      taskId,
+      update: { comment }
+    });
+    if (result.updated) {
+      return;
+    }
+    throw new Error(result.source === "plugin" || result.sourceKind ? `configured task source${result.sourceKind ? ` (${result.sourceKind})` : ""} does not support comment updates` : "no source-aware task source is configured");
+  } catch (error) {
+    let fallbackUpdated = false;
+    try {
+      const sourceIssueId = loadRuntimeContextFromEnv2()?.sourceTask?.sourceIssueId;
+      fallbackUpdated = taskData3.updateGithubIssueTaskBySourceIssueId(sourceIssueId, taskId, { comment });
+      fallbackUpdated = taskData3.updateSourceAwareTaskConfigTask(projectRoot, taskId, { comment }) || fallbackUpdated;
+    } catch (fallbackError) {
+      console.error(`[rig-agent] Snapshot-missing compatibility comment also failed for ${taskId}: ${fallbackError instanceof Error ? fallbackError.message : String(fallbackError)}`);
+    }
+    const message = `[rig-agent] Failed to record snapshot-missing evidence for ${taskId}${fallbackUpdated ? "; applied source-aware compatibility comment" : ""}: ${error instanceof Error ? error.message : String(error)}`;
+    if (fallbackUpdated) {
+      console.log(message);
+    } else {
+      console.error(message);
+    }
+  }
+}
+async function updateTaskSourceAfterRun(projectRoot, taskId, runtime) {
+  const taskData3 = await resolveTaskDataService(projectRoot);
+  const comment = taskData3.buildTaskRunLifecycleComment({
+    runId: process.env.RIG_SERVER_RUN_ID || "(unknown)",
+    status: "completed",
+    summary: "Rig task run completed; source closeout waits for approved PR merge.",
+    runtimeWorkspace: runtime.workspaceDir,
+    logsDir: runtime.logsDir,
+    sessionDir: runtime.sessionDir
+  });
+  try {
+    const result = await taskData3.updateConfiguredTaskSourceTask(projectRoot, {
+      taskId,
+      update: { status: "completed", comment }
+    });
+    if (result.updated) {
+      return;
+    }
+    throw new Error(result.source === "plugin" || result.sourceKind ? `configured task source${result.sourceKind ? ` (${result.sourceKind})` : ""} does not support lifecycle updates` : "no source-aware task source is configured");
+  } catch (error) {
+    let fallbackUpdated = false;
+    try {
+      const sourceIssueId = loadRuntimeContextFromEnv2()?.sourceTask?.sourceIssueId;
+      fallbackUpdated = taskData3.updateGithubIssueTaskBySourceIssueId(sourceIssueId, taskId, { status: "completed", comment });
+      fallbackUpdated = taskData3.updateSourceAwareTaskConfigTask(projectRoot, taskId, { status: "completed", comment }) || fallbackUpdated;
+    } catch (fallbackError) {
+      console.error(`[rig-agent] Source-aware compatibility update also failed for ${taskId}: ${fallbackError instanceof Error ? fallbackError.message : String(fallbackError)}`);
+    }
+    const message = `[rig-agent] Failed to update task source for ${taskId}${fallbackUpdated ? "; applied source-aware compatibility update" : ""}: ${error instanceof Error ? error.message : String(error)}`;
+    if (fallbackUpdated) {
+      console.log(message);
+    } else {
+      console.error(message);
+    }
+  }
+}
+function resolveRuntimeHandoffPath(hostProjectRoot, taskId, timestampMs = Date.now()) {
+  const handoffDir = resolve5(hostProjectRoot, ".rig/runtime/handoffs");
+  const safeTaskId = safePathSegment(taskId, { fallback: "task", maxLength: 96 });
+  return assertPathInsideRoot(handoffDir, resolve5(handoffDir, `${safeTaskId}-${timestampMs}.json`), "runtime handoff path");
+}
+function recordRuntimeHandoff(hostProjectRoot, runtime, taskId, exitCode, options = {}) {
+  const handoffDir = resolve5(hostProjectRoot, ".rig/runtime/handoffs");
+  mkdirSync3(handoffDir, { recursive: true });
+  const handoffPath = resolveRuntimeHandoffPath(hostProjectRoot, taskId);
+  const snapshotMissing = options.snapshotMissing === true;
+  const handoff = {
+    taskId,
+    runtimeId: runtime.id,
+    runtimeMode: runtime.mode,
+    workspaceDir: runtime.workspaceDir,
+    logsDir: runtime.logsDir,
+    sessionDir: runtime.sessionDir,
+    exitCode,
+    degraded: snapshotMissing,
+    snapshotMissing,
+    snapshotFinalizeError: options.snapshotFinalizeError ?? null,
+    recordedAt: new Date().toISOString(),
+    message: snapshotMissing ? "Runtime completed but the after-snapshot finalize failed; closeout evidence is degraded until the runtime workspace is inspected directly." : "Completion verification did not finish in this run. Open or refresh the PR from the runtime workspace for verifier review, or rerun completion verification once the workspace is ready.",
+    nextSteps: snapshotMissing ? [
+      `cd ${runtime.workspaceDir}`,
+      "inspect the runtime workspace directly before relying on closeout evidence",
+      `rig git status --task ${taskId}`
+    ] : [
+      `cd ${runtime.workspaceDir}`,
+      `rig git status --task ${taskId}`,
+      `rig completion-verification --task ${taskId}`,
+      `rig git open-pr --task ${taskId}`
+    ]
+  };
+  writeFileSync3(handoffPath, `${JSON.stringify(handoff, null, 2)}
+`, "utf-8");
+  if (snapshotMissing) {
+    console.log(`[rig-agent] Runtime after-snapshot missing for ${taskId}; degraded handoff saved: ${handoffPath}`);
+    console.log(`[rig-agent] Inspect runtime workspace before relying on closeout evidence: ${runtime.workspaceDir}`);
+  } else {
+    console.log(`[rig-agent] Completion verification paused for ${taskId}.`);
+    console.log(`[rig-agent] Runtime handoff saved: ${handoffPath}`);
+    console.log(`[rig-agent] Review and open PR from runtime workspace: ${runtime.workspaceDir}`);
+  }
+}
+async function printTaskContext(projectRoot, taskId) {
+  const metadata = await readTaskMetadata(projectRoot, taskId);
+  const configHints = await readTaskConfigHints(projectRoot, taskId);
+  const description = firstNonEmpty(metadata?.description, configHints.description);
+  const acceptanceCriteria = firstNonEmpty(metadata?.acceptanceCriteria, configHints.acceptanceCriteria);
+  if (metadata?.title) {
+    console.log(`[rig-agent] Task ${taskId}: ${metadata.title}`);
+  } else {
+    console.log(`[rig-agent] Task ${taskId}`);
+  }
+  if (description) {
+    console.log("[rig-agent] Description:");
+    for (const line of description.split(/\r?\n/)) {
+      console.log(`[rig-agent]   ${line}`);
+    }
+  } else {
+    console.log(`[rig-agent] Description: (not set; use \`br update ${taskId} --description "..."\`)`);
+  }
+  if (acceptanceCriteria) {
+    console.log("[rig-agent] Acceptance Criteria:");
+    for (const line of acceptanceCriteria.split(/\r?\n/)) {
+      console.log(`[rig-agent]   ${line}`);
+    }
+  }
+}
+async function readTaskMetadata(taskRoot, taskId) {
+  const parsed = await runBeadsJson(taskRoot, ["show", taskId]);
+  if (!parsed) {
+    return null;
+  }
+  const record = Array.isArray(parsed) ? parsed[0] : parsed;
+  if (!record || typeof record !== "object" || Array.isArray(record)) {
+    return null;
+  }
+  const value = record;
+  return {
+    title: asNonEmptyString(value.title),
+    description: asNonEmptyString(value.description),
+    acceptanceCriteria: firstNonEmpty(asNonEmptyString(value.acceptance_criteria), asNonEmptyString(value.acceptanceCriteria))
+  };
+}
+async function readTaskConfigHints(taskRoot, taskId) {
+  const runtimeContext = loadRuntimeContextFromEnv2();
+  const candidates = [
+    runtimeContext?.monorepoMainRoot ? resolve5(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
+    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve5(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
+    resolve5(taskRoot, ".rig", "task-config.json"),
+    resolve5(taskRoot, "rig", "task-config.json")
+  ].filter(Boolean);
+  for (const configPath of candidates) {
+    if (!existsSync5(configPath)) {
+      continue;
+    }
+    try {
+      const config = await Bun.file(configPath).json();
+      const entry = config[taskId] || {};
+      return {
+        description: asNonEmptyString(entry.description),
+        acceptanceCriteria: asNonEmptyString(entry.acceptance_criteria)
+      };
+    } catch {
+      continue;
+    }
+  }
+  return { description: "", acceptanceCriteria: "" };
+}
+function asNonEmptyString(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function firstNonEmpty(...values) {
+  for (const value of values) {
+    if (typeof value === "string" && value.trim()) {
+      return value.trim();
+    }
+  }
+  return "";
+}
+var taskDataServiceByRoot, requireFromRuntime, runPiRpcProvider;
+var init_agent_wrapper = __esm(() => {
+  init_runtime_snapshot_config();
+  taskDataServiceByRoot = new Map;
+  requireFromRuntime = createRequire(import.meta.url);
+  runPiRpcProvider = runPiRpcProviderFallback;
+  if (false) {}
+});
+
+// packages/provider-plugin/src/tooling/browser-tool-entrypoint.ts
+var exports_browser_tool_entrypoint = {};
+import { existsSync as existsSync6, rmSync as rmSync2 } from "fs";
+import { basename as basename2, dirname as dirname3, resolve as resolve6 } from "path";
+import { loadRuntimeContext as loadRuntimeContext3 } from "@rig/core/runtime-context";
+function currentCommand() {
+  return basename2(process.argv[1] || "");
+}
+function runtimeContextPath() {
+  const explicit = process.env.RIG_RUNTIME_CONTEXT_FILE?.trim();
+  if (explicit) {
+    return explicit;
+  }
+  return resolve6(dirname3(resolve6(process.argv[1] || "")), "..", "runtime-context.json");
+}
+function loadBrowserContext() {
+  const contextPath = runtimeContextPath();
+  if (!existsSync6(contextPath)) {
+    throw new Error(`Runtime context file not found for ${currentCommand()}: ${contextPath}`);
+  }
+  const runtimeContext = loadRuntimeContext3(contextPath);
+  if (!runtimeContext.browser?.required) {
+    throw new Error(`No browser contract is configured for ${runtimeContext.taskId}.`);
+  }
+  if (!runtimeContext.hostProjectRoot) {
+    throw new Error(`Runtime browser command ${currentCommand()} requires hostProjectRoot in runtime context.`);
+  }
+  return {
+    browser: runtimeContext.browser,
+    hostProjectRoot: runtimeContext.hostProjectRoot
+  };
+}
+async function runConfiguredCommand(command, browser, hostProjectRoot) {
+  if (!command) {
+    throw new Error(`No backing command is configured for ${currentCommand()}.`);
+  }
+  const attachUrl = new URL(browser.effectiveAttachUrl);
+  const child = Bun.spawn({
+    cmd: ["/bin/bash", "-lc", command],
+    cwd: hostProjectRoot,
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit",
+    env: {
+      ...process.env,
+      RIG_STATE_DIR: browser.stateDir,
+      T3CODE_STATE_DIR: browser.stateDir,
+      RIG_BROWSER_PROFILE: browser.effectiveProfile,
+      RIG_BROWSER_REMOTE_DEBUGGING_PORT: attachUrl.port,
+      RIG_BROWSER_ATTACH_URL: browser.effectiveAttachUrl
+    }
+  });
+  return await child.exited;
+}
+function printAttachInfo(browser, hostProjectRoot) {
+  const payload = {
+    preset: browser.preset,
+    mode: browser.mode,
+    stateDir: browser.stateDir,
+    hostProjectRoot,
+    defaultProfile: browser.defaultProfile,
+    effectiveProfile: browser.effectiveProfile,
+    defaultAttachUrl: browser.defaultAttachUrl,
+    effectiveAttachUrl: browser.effectiveAttachUrl,
+    launchHelper: browser.launchHelper,
+    checkHelper: browser.checkHelper,
+    attachInfoHelper: browser.attachInfoHelper,
+    e2eHelper: browser.e2eHelper,
+    resetProfileHelper: browser.resetProfileHelper,
+    devCommand: browser.devCommand,
+    launchCommand: browser.launchCommand,
+    checkCommand: browser.checkCommand,
+    e2eCommand: browser.e2eCommand
+  };
+  if (process.argv.includes("--json")) {
+    console.log(JSON.stringify(payload, null, 2));
+    return;
+  }
+  console.log("Rig Browser");
+  console.log(`  Preset: ${browser.preset}`);
+  console.log(`  Mode: ${browser.mode}`);
+  console.log(`  State dir: ${browser.stateDir}`);
+  console.log(`  Default profile: ${browser.defaultProfile}`);
+  console.log(`  Effective profile: ${browser.effectiveProfile}`);
+  console.log(`  Default attach URL: ${browser.defaultAttachUrl}`);
+  console.log(`  Effective attach URL: ${browser.effectiveAttachUrl}`);
+  console.log(`  Launch helper: ${browser.launchHelper}${browser.devCommand ? " [--dev]" : ""}`);
+  console.log(`  Check helper: ${browser.checkHelper}`);
+  console.log(`  E2E helper: ${browser.e2eHelper}`);
+  console.log(`  Reset helper: ${browser.resetProfileHelper}`);
+}
+function resetProfile(browser) {
+  const profileRoot = resolve6(browser.stateDir, "browser", "profiles", browser.effectiveProfile);
+  rmSync2(profileRoot, { recursive: true, force: true });
+  console.log(`Removed Rig Browser profile: ${profileRoot}`);
+}
+async function main2() {
+  const { browser, hostProjectRoot } = loadBrowserContext();
+  const command = currentCommand();
+  if (command === browser.attachInfoHelper) {
+    printAttachInfo(browser, hostProjectRoot);
+    return;
+  }
+  if (command === browser.resetProfileHelper) {
+    resetProfile(browser);
+    return;
+  }
+  if (command === browser.launchHelper) {
+    const launchCommand = process.argv.includes("--dev") ? browser.devCommand : browser.launchCommand;
+    process.exit(await runConfiguredCommand(launchCommand, browser, hostProjectRoot));
+  }
+  if (command === browser.checkHelper) {
+    process.exit(await runConfiguredCommand(browser.checkCommand, browser, hostProjectRoot));
+  }
+  if (command === browser.e2eHelper) {
+    process.exit(await runConfiguredCommand(browser.e2eCommand ?? browser.checkCommand, browser, hostProjectRoot));
+  }
+  throw new Error(`Unknown Rig Browser helper: ${command}`);
+}
+var init_browser_tool_entrypoint = __esm(() => {
+  main2().catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  });
+});
 
 // packages/provider-plugin/src/runtime-instructions.ts
 function normalizeRuntimeInstructionProvider(_value) {
@@ -52,22 +2357,1068 @@ var init_service = __esm(() => {
   runtimeInstructionService = svc;
 });
 
+// packages/provider-plugin/src/skill-materializer.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync4, readdirSync as readdirSync2, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
+import { resolve as resolve7 } from "path";
+import { loadSkill } from "@rig/skill-loader";
+function skillDirName(id) {
+  return id.replace(/[^a-zA-Z0-9._-]+/g, "-");
+}
+async function materializeSkills(projectRoot, entries) {
+  const skillsRoot = resolve7(projectRoot, ".pi", "skills");
+  if (existsSync7(skillsRoot)) {
+    for (const name of readdirSync2(skillsRoot)) {
+      const dir = resolve7(skillsRoot, name);
+      if (existsSync7(resolve7(dir, MARKER_FILENAME))) {
+        rmSync3(dir, { recursive: true, force: true });
+      }
+    }
+  }
+  const written = [];
+  for (const { pluginName, skill } of entries) {
+    const sourcePath = resolve7(projectRoot, skill.path);
+    if (!existsSync7(sourcePath)) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${sourcePath} does not exist`);
+      continue;
+    }
+    let body;
+    try {
+      await loadSkill(sourcePath);
+      body = readFileSync4(sourcePath, "utf-8");
+    } catch (err) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${err instanceof Error ? err.message : err}`);
+      continue;
+    }
+    const dir = resolve7(skillsRoot, skillDirName(skill.id));
+    mkdirSync4(dir, { recursive: true });
+    writeFileSync4(resolve7(dir, "SKILL.md"), body, "utf-8");
+    writeFileSync4(resolve7(dir, MARKER_FILENAME), `${JSON.stringify({ plugin: pluginName, skillId: skill.id }, null, 2)}
+`, "utf-8");
+    written.push({ id: skill.id, pluginName, directory: dir });
+  }
+  return written;
+}
+var MARKER_FILENAME = ".rig-plugin";
+var init_skill_materializer = () => {};
+
+// packages/provider-plugin/src/pi-settings-materializer.ts
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname4, resolve as resolve8 } from "path";
+function readJson(path, fallback) {
+  if (!existsSync8(path))
+    return fallback;
+  try {
+    return JSON.parse(readFileSync5(path, "utf-8"));
+  } catch {
+    return fallback;
+  }
+}
+function packageKey(entry) {
+  if (typeof entry === "string")
+    return entry;
+  if (entry && typeof entry === "object" && typeof entry.source === "string") {
+    return entry.source;
+  }
+  return JSON.stringify(entry);
+}
+function materializePiPackages(projectRoot, declaredPackages) {
+  const settingsPath = resolve8(projectRoot, SETTINGS_RELATIVE_PATH);
+  const managedRecordPath = resolve8(projectRoot, MANAGED_RECORD_RELATIVE_PATH);
+  const settings = readJson(settingsPath, {});
+  const previouslyManaged = new Set(readJson(managedRecordPath, []));
+  const existing = Array.isArray(settings.packages) ? settings.packages : [];
+  const operatorEntries = existing.filter((entry) => !previouslyManaged.has(packageKey(entry)));
+  const operatorKeys = new Set(operatorEntries.map(packageKey));
+  const managedToAdd = declaredPackages.filter((pkg) => !operatorKeys.has(pkg));
+  const nextPackages = [...operatorEntries, ...managedToAdd];
+  if (nextPackages.length > 0 || existsSync8(settingsPath)) {
+    const nextSettings = { ...settings };
+    if (nextPackages.length > 0) {
+      nextSettings.packages = nextPackages;
+    } else {
+      delete nextSettings.packages;
+    }
+    mkdirSync5(dirname4(settingsPath), { recursive: true });
+    writeFileSync5(settingsPath, `${JSON.stringify(nextSettings, null, 2)}
+`, "utf-8");
+  }
+  mkdirSync5(dirname4(managedRecordPath), { recursive: true });
+  writeFileSync5(managedRecordPath, `${JSON.stringify(managedToAdd, null, 2)}
+`, "utf-8");
+  return { settingsPath, packages: managedToAdd };
+}
+var SETTINGS_RELATIVE_PATH = ".pi/settings.json", MANAGED_RECORD_RELATIVE_PATH = ".rig/state/pi-managed-packages.json";
+var init_pi_settings_materializer = () => {};
+
+// packages/provider-plugin/src/session-asset-materializer-service.ts
+var exports_session_asset_materializer_service = {};
+__export(exports_session_asset_materializer_service, {
+  sessionAssetMaterializer: () => sessionAssetMaterializer
+});
+import { existsSync as existsSync9 } from "fs";
+import { resolve as resolvePath } from "path";
+var sessionAssetMaterializer;
+var init_session_asset_materializer_service = __esm(() => {
+  init_skill_materializer();
+  init_pi_settings_materializer();
+  sessionAssetMaterializer = {
+    async materializeSessionAssets(projectRoot, config) {
+      try {
+        const skillEntries = config.plugins.flatMap((plugin) => (plugin.contributes?.skills ?? []).map((skill) => ({
+          pluginName: plugin.name,
+          skill
+        })));
+        if (skillEntries.length > 0) {
+          await materializeSkills(projectRoot, skillEntries);
+        }
+      } catch (err) {
+        console.warn(`[session-assets] skill materialization failed: ${err instanceof Error ? err.message : err}`);
+      }
+      try {
+        const piPackages = config.runtime?.pi?.packages ?? [];
+        if (piPackages.length > 0 || existsSync9(resolvePath(projectRoot, ".rig/state/pi-managed-packages.json"))) {
+          materializePiPackages(projectRoot, piPackages);
+        }
+      } catch (err) {
+        console.warn(`[session-assets] Pi package materialization failed: ${err instanceof Error ? err.message : err}`);
+      }
+    }
+  };
+});
+
+// packages/provider-plugin/src/tooling/embedded-native-assets.ts
+var embeddedNatives = null;
+
+// packages/provider-plugin/src/tooling/native-extract.ts
+import { existsSync as existsSync10, mkdirSync as mkdirSync6, readFileSync as readFileSync6, renameSync, statSync, writeFileSync as writeFileSync6 } from "fs";
+import { tmpdir } from "os";
+import { resolve as resolve9 } from "path";
+function hasEmbeddedNatives() {
+  return embeddedNatives != null;
+}
+function extractEmbeddedNative(name) {
+  if (name in extractionCache) {
+    return extractionCache[name] ?? null;
+  }
+  const entry = embeddedNatives?.[name];
+  if (!entry) {
+    extractionCache[name] = null;
+    return null;
+  }
+  try {
+    const targetPath = resolve9(sharedNativeOutputDir, entry.fileName);
+    mkdirSync6(sharedNativeOutputDir, { recursive: true });
+    const upToDate = existsSync10(targetPath) && statSync(targetPath).size === entry.size;
+    if (!upToDate) {
+      const bytes = readFileSync6(entry.filePath);
+      const tempPath = `${targetPath}.${process.pid}.${Date.now()}.tmp`;
+      writeFileSync6(tempPath, bytes, { mode: 493 });
+      renameSync(tempPath, targetPath);
+    }
+    extractionCache[name] = targetPath;
+  } catch {
+    extractionCache[name] = null;
+  }
+  return extractionCache[name] ?? null;
+}
+var sharedNativeOutputDir, extractionCache;
+var init_native_extract = __esm(() => {
+  sharedNativeOutputDir = resolve9(tmpdir(), "rig-native");
+  extractionCache = {};
+});
+
+// packages/provider-plugin/src/tooling/shell-tools.ts
+import { chmodSync, copyFileSync, existsSync as existsSync11, mkdirSync as mkdirSync7 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { basename as basename3, dirname as dirname5, resolve as resolve10 } from "path";
+import { RUNTIME_SHELL_TOOL_NAMES } from "@rig/contracts";
+function runtimeRigShellFileName() {
+  return `rig-shell${process.platform === "win32" ? ".exe" : ""}`;
+}
+async function ensureRigShellBinaryPath(outputPath = sharedNativeShellOutputPath) {
+  const explicitBin = process.env.RIG_NATIVE_SHELL_BIN?.trim();
+  if (explicitBin && existsSync11(explicitBin)) {
+    return explicitBin;
+  }
+  const embedded = extractEmbeddedNative("rig-shell");
+  if (embedded) {
+    return embedded;
+  }
+  const sourcePath = resolveRigShellSourcePath();
+  if (!sourcePath) {
+    const bundledBinary = resolveBundledRigShellBinaryPath();
+    if (bundledBinary) {
+      return bundledBinary;
+    }
+    throw new Error("rig-shell.zig source file not found.");
+  }
+  const zigBinary = Bun.which("zig");
+  if (!zigBinary) {
+    throw new Error("zig is required to build the native Rig shell.");
+  }
+  mkdirSync7(dirname5(outputPath), { recursive: true });
+  const sourceDigest = await sha256File(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    zigBinary,
+    platform: process.platform,
+    arch: process.arch,
+    sourcePath,
+    sourceDigest
+  });
+  const manifestPath = nativeBuildManifestPath(outputPath);
+  const needsBuild = !existsSync11(outputPath) || !await hasMatchingNativeBuildManifest(manifestPath, buildKey);
+  if (!needsBuild) {
+    return outputPath;
+  }
+  const build = Bun.spawn([
+    zigBinary,
+    "build-exe",
+    sourcePath,
+    "-O",
+    "ReleaseFast",
+    `-femit-bin=${outputPath}`
+  ], {
+    cwd: dirname5(sourcePath),
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    build.exited,
+    new Response(build.stdout).text(),
+    new Response(build.stderr).text()
+  ]);
+  if (exitCode !== 0 || !existsSync11(outputPath)) {
+    const details = [stderr.trim(), stdout.trim()].filter(Boolean).join(`
+`);
+    throw new Error(`Failed to build native Rig shell: ${details || `zig exited with code ${exitCode}`}`);
+  }
+  await Bun.write(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`);
+  return outputPath;
+}
+async function materializeRigShellBinary(targetDir) {
+  const sourcePath = await ensureRigShellBinaryPath();
+  const targetPath = resolve10(targetDir, runtimeRigShellFileName());
+  mkdirSync7(targetDir, { recursive: true });
+  const sourceDigest = await sha256File(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    sourcePath,
+    sourceDigest
+  });
+  const needsCopy = !existsSync11(targetPath) || !await hasMatchingNativeBuildManifest(nativeBuildManifestPath(targetPath), buildKey);
+  if (needsCopy) {
+    copyFileSync(sourcePath, targetPath);
+    chmodSync(targetPath, 493);
+    await Bun.write(nativeBuildManifestPath(targetPath), `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`);
+  }
+  return targetPath;
+}
+function resolveRigShellSourcePath() {
+  for (const candidate of rigShellSourceCandidates()) {
+    if (candidate && existsSync11(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function resolveBundledRigShellBinaryPath() {
+  for (const candidate of rigShellBinaryCandidates()) {
+    if (candidate && existsSync11(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function rigShellSourceCandidates() {
+  const execDir = process.execPath?.trim() ? dirname5(process.execPath.trim()) : "";
+  const cwd = process.cwd()?.trim() || "";
+  const projectRoot = process.env.PROJECT_RIG_ROOT?.trim() || "";
+  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || "";
+  return [...new Set([
+    process.env.RIG_NATIVE_SHELL_SOURCE?.trim() || "",
+    cwd ? resolve10(cwd, "packages/provider-plugin/native/rig-shell.zig") : "",
+    projectRoot ? resolve10(projectRoot, "packages/provider-plugin/native/rig-shell.zig") : "",
+    hostProjectRoot ? resolve10(hostProjectRoot, "packages/provider-plugin/native/rig-shell.zig") : "",
+    execDir ? resolve10(execDir, "..", "..", "packages/provider-plugin/native/rig-shell.zig") : "",
+    execDir ? resolve10(execDir, "..", "native", "rig-shell.zig") : "",
+    resolve10(import.meta.dir, "../../native/rig-shell.zig")
+  ].filter(Boolean))];
+}
+function nativePackageBinaryCandidates(fromDir, fileName) {
+  const candidates = [];
+  let cursor = resolve10(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    candidates.push(resolve10(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve10(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve10(cursor, "native", fileName), resolve10(cursor, "native", "bin", fileName));
+    const parent = dirname5(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
+  }
+  return candidates;
+}
+function rigShellBinaryCandidates() {
+  const execDir = process.execPath?.trim() ? dirname5(process.execPath.trim()) : "";
+  const fileName = runtimeRigShellFileName();
+  return [...new Set([
+    process.env.RIG_NATIVE_SHELL_BIN?.trim() || "",
+    ...nativePackageBinaryCandidates(import.meta.dir, fileName),
+    execDir ? resolve10(execDir, fileName) : "",
+    execDir ? resolve10(execDir, "..", fileName) : "",
+    execDir ? resolve10(execDir, "..", "bin", fileName) : ""
+  ].filter(Boolean))];
+}
+function nativeBuildManifestPath(outputPath) {
+  return `${outputPath}.build-manifest.json`;
+}
+async function hasMatchingNativeBuildManifest(manifestPath, buildKey) {
+  if (!existsSync11(manifestPath)) {
+    return false;
+  }
+  try {
+    const manifest = await Bun.file(manifestPath).json();
+    return manifest.version === 1 && manifest.buildKey === buildKey;
+  } catch {
+    return false;
+  }
+}
+async function sha256File(path) {
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(await Bun.file(path).arrayBuffer());
+  return hasher.digest("hex");
+}
+var sharedNativeShellOutputDir, sharedNativeShellOutputPath;
+var init_shell_tools = __esm(() => {
+  init_native_extract();
+  sharedNativeShellOutputDir = resolve10(tmpdir2(), "rig-native");
+  sharedNativeShellOutputPath = resolve10(sharedNativeShellOutputDir, `rig-shell-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+});
+
+// packages/provider-plugin/src/tooling/browser-tools.ts
+var exports_browser_tools = {};
+__export(exports_browser_tools, {
+  runtimeBrowserToolNames: () => runtimeBrowserToolNames,
+  runtimeBrowserToolBinaryName: () => runtimeBrowserToolBinaryName,
+  materializeRuntimeBrowserTools: () => materializeRuntimeBrowserTools
+});
+import { existsSync as existsSync12, rmSync as rmSync4, symlinkSync } from "fs";
+import { resolve as resolve11 } from "path";
+import { RUNTIME_BROWSER_TOOL_NAMES } from "@rig/contracts";
+function runtimeBrowserToolBinaryName() {
+  return `rig-browser-tool${process.platform === "win32" ? ".exe" : ""}`;
+}
+function runtimeBrowserToolNames() {
+  return [...RUNTIME_BROWSER_TOOL_NAMES];
+}
+async function materializeRuntimeBrowserTools(targetDir) {
+  const binaryPath = resolve11(targetDir, runtimeBrowserToolBinaryName());
+  for (const tool of runtimeBrowserToolNames()) {
+    const toolPath = resolve11(targetDir, tool);
+    if (existsSync12(toolPath)) {
+      rmSync4(toolPath, { force: true, recursive: true });
+    }
+    symlinkSync(binaryPath, toolPath);
+  }
+  return binaryPath;
+}
+var init_browser_tools = () => {};
+
+// packages/provider-plugin/src/tooling/file-tools.ts
+var exports_file_tools = {};
+__export(exports_file_tools, {
+  runtimeRigToolsFileName: () => runtimeRigToolsFileName,
+  runtimeFileToolNames: () => runtimeFileToolNames,
+  runtimeFileToolBasename: () => runtimeFileToolBasename,
+  materializeRuntimeFileTools: () => materializeRuntimeFileTools,
+  ensureRigToolsBinaryPath: () => ensureRigToolsBinaryPath
+});
+import { chmodSync as chmodSync2, copyFileSync as copyFileSync2, existsSync as existsSync13, mkdirSync as mkdirSync8, rmSync as rmSync5, symlinkSync as symlinkSync2 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { basename as basename4, dirname as dirname6, resolve as resolve12 } from "path";
+import { RUNTIME_FILE_TOOL_NAMES } from "@rig/contracts";
+function runtimeRigToolsFileName() {
+  return `rig-tools${process.platform === "win32" ? ".exe" : ""}`;
+}
+function runtimeFileToolNames() {
+  return [...RUNTIME_FILE_TOOL_NAMES];
+}
+async function ensureRigToolsBinaryPath(outputPath = sharedNativeToolsOutputPath) {
+  const explicitBin = process.env.RIG_NATIVE_TOOLS_BIN?.trim();
+  if (explicitBin && existsSync13(explicitBin)) {
+    return explicitBin;
+  }
+  const embedded = extractEmbeddedNative("rig-tools");
+  if (embedded) {
+    return embedded;
+  }
+  const sourcePath = resolveRigToolsSourcePath();
+  if (!sourcePath) {
+    const bundledBinary = resolveBundledRigToolsBinaryPath();
+    if (bundledBinary) {
+      return bundledBinary;
+    }
+    throw new Error("rig-tools.zig source file not found.");
+  }
+  const zigBinary = Bun.which("zig");
+  if (!zigBinary) {
+    throw new Error("zig is required to build native Rig file tools.");
+  }
+  mkdirSync8(dirname6(outputPath), { recursive: true });
+  const sourceDigest = await sha256File2(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    zigBinary,
+    platform: process.platform,
+    arch: process.arch,
+    sourcePath,
+    sourceDigest
+  });
+  const manifestPath = nativeBuildManifestPath2(outputPath);
+  const needsBuild = !existsSync13(outputPath) || !await hasMatchingNativeBuildManifest2(manifestPath, buildKey);
+  if (!needsBuild) {
+    return outputPath;
+  }
+  const build = Bun.spawn([
+    zigBinary,
+    "build-exe",
+    sourcePath,
+    "-O",
+    "ReleaseFast",
+    `-femit-bin=${outputPath}`
+  ], {
+    cwd: dirname6(sourcePath),
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    build.exited,
+    new Response(build.stdout).text(),
+    new Response(build.stderr).text()
+  ]);
+  if (exitCode !== 0 || !existsSync13(outputPath)) {
+    const details = [stderr.trim(), stdout.trim()].filter(Boolean).join(`
+`);
+    throw new Error(`Failed to build native Rig file tools: ${details || `zig exited with code ${exitCode}`}`);
+  }
+  await Bun.write(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`);
+  return outputPath;
+}
+async function materializeRuntimeFileTools(targetDir) {
+  const sourcePath = await ensureRigToolsBinaryPath();
+  const targetPath = resolve12(targetDir, runtimeRigToolsFileName());
+  mkdirSync8(targetDir, { recursive: true });
+  const sourceDigest = await sha256File2(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    sourcePath,
+    sourceDigest
+  });
+  const needsCopy = !existsSync13(targetPath) || !await hasMatchingNativeBuildManifest2(nativeBuildManifestPath2(targetPath), buildKey);
+  if (needsCopy) {
+    copyFileSync2(sourcePath, targetPath);
+    chmodSync2(targetPath, 493);
+    await Bun.write(nativeBuildManifestPath2(targetPath), `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`);
+  }
+  for (const tool of runtimeFileToolNames()) {
+    const toolPath = resolve12(targetDir, tool);
+    if (existsSync13(toolPath)) {
+      rmSync5(toolPath, { force: true, recursive: true });
+    }
+    symlinkSync2(targetPath, toolPath);
+  }
+  return targetPath;
+}
+function resolveRigToolsSourcePath() {
+  for (const candidate of rigToolsSourceCandidates()) {
+    if (candidate && existsSync13(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function resolveBundledRigToolsBinaryPath() {
+  for (const candidate of rigToolsBinaryCandidates()) {
+    if (candidate && existsSync13(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function rigToolsSourceCandidates() {
+  const execDir = process.execPath?.trim() ? dirname6(process.execPath.trim()) : "";
+  const cwd = process.cwd()?.trim() || "";
+  const projectRoot = process.env.PROJECT_RIG_ROOT?.trim() || "";
+  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || "";
+  return [...new Set([
+    process.env.RIG_NATIVE_TOOLS_SOURCE?.trim() || "",
+    cwd ? resolve12(cwd, "packages/provider-plugin/native/rig-tools.zig") : "",
+    projectRoot ? resolve12(projectRoot, "packages/provider-plugin/native/rig-tools.zig") : "",
+    hostProjectRoot ? resolve12(hostProjectRoot, "packages/provider-plugin/native/rig-tools.zig") : "",
+    execDir ? resolve12(execDir, "..", "..", "packages/provider-plugin/native/rig-tools.zig") : "",
+    execDir ? resolve12(execDir, "..", "native", "rig-tools.zig") : "",
+    resolve12(import.meta.dir, "../../native/rig-tools.zig")
+  ].filter(Boolean))];
+}
+function nativePackageBinaryCandidates2(fromDir, fileName) {
+  const candidates = [];
+  let cursor = resolve12(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    candidates.push(resolve12(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve12(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve12(cursor, "native", fileName), resolve12(cursor, "native", "bin", fileName));
+    const parent = dirname6(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
+  }
+  return candidates;
+}
+function rigToolsBinaryCandidates() {
+  const execDir = process.execPath?.trim() ? dirname6(process.execPath.trim()) : "";
+  const fileName = runtimeRigToolsFileName();
+  return [...new Set([
+    process.env.RIG_NATIVE_TOOLS_BIN?.trim() || "",
+    ...nativePackageBinaryCandidates2(import.meta.dir, fileName),
+    execDir ? resolve12(execDir, fileName) : "",
+    execDir ? resolve12(execDir, "..", fileName) : "",
+    execDir ? resolve12(execDir, "..", "bin", fileName) : ""
+  ].filter(Boolean))];
+}
+function runtimeFileToolBasename(path) {
+  return basename4(path);
+}
+function nativeBuildManifestPath2(outputPath) {
+  return `${outputPath}.build-manifest.json`;
+}
+async function hasMatchingNativeBuildManifest2(manifestPath, buildKey) {
+  if (!existsSync13(manifestPath)) {
+    return false;
+  }
+  try {
+    const manifest = await Bun.file(manifestPath).json();
+    return manifest.version === 1 && manifest.buildKey === buildKey;
+  } catch {
+    return false;
+  }
+}
+async function sha256File2(path) {
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(await Bun.file(path).arrayBuffer());
+  return hasher.digest("hex");
+}
+var sharedNativeToolsOutputDir, sharedNativeToolsOutputPath;
+var init_file_tools = __esm(() => {
+  init_native_extract();
+  sharedNativeToolsOutputDir = resolve12(tmpdir3(), "rig-native");
+  sharedNativeToolsOutputPath = resolve12(sharedNativeToolsOutputDir, `rig-tools-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+});
+
+// packages/provider-plugin/src/tooling/gateway.ts
+var exports_gateway = {};
+__export(exports_gateway, {
+  runtimeGatewayToolNames: () => runtimeGatewayToolNames,
+  runtimeFileToolNames: () => runtimeFileToolNames,
+  runtimeBrowserToolNames: () => runtimeBrowserToolNames,
+  materializeRuntimeToolGateway: () => materializeRuntimeToolGateway,
+  materializeRuntimeFileTools: () => materializeRuntimeFileTools,
+  materializeRuntimeBrowserTools: () => materializeRuntimeBrowserTools
+});
+import { existsSync as existsSync14, rmSync as rmSync6, symlinkSync as symlinkSync3 } from "fs";
+import { resolve as resolve13 } from "path";
+import { RUNTIME_SHELL_TOOL_NAMES as RUNTIME_SHELL_TOOL_NAMES2 } from "@rig/contracts";
+function runtimeGatewayToolNames() {
+  return [...RUNTIME_SHELL_TOOL_NAMES2];
+}
+async function materializeRuntimeToolGateway(binDir) {
+  const shellPath = await materializeRigShellBinary(binDir);
+  for (const tool of runtimeGatewayToolNames()) {
+    const toolPath = resolve13(binDir, tool);
+    if (existsSync14(toolPath)) {
+      rmSync6(toolPath, { force: true, recursive: true });
+    }
+    symlinkSync3(shellPath, toolPath);
+  }
+  await materializeRuntimeBrowserTools(binDir);
+  return resolve13(binDir, runtimeRigShellFileName());
+}
+var init_gateway = __esm(() => {
+  init_shell_tools();
+  init_browser_tools();
+  init_browser_tools();
+  init_file_tools();
+});
+
+// packages/provider-plugin/src/tooling/runtime-binary-build.ts
+import { chmodSync as chmodSync3, copyFileSync as copyFileSync3, cpSync, existsSync as existsSync15, linkSync, mkdirSync as mkdirSync9, renameSync as renameSync2, rmSync as rmSync7, writeFileSync as writeFileSync7 } from "fs";
+import { basename as basename5, dirname as dirname7, resolve as resolve14 } from "path";
+import { fileURLToPath } from "url";
+import { drainMicrotasks, gcAndSweep } from "bun:jsc";
+import { resolveRigLayout as resolveRigLayout2 } from "@rig/core/layout";
+import { runtimeProvisioningEnv } from "@rig/core/runtime-provisioning-env";
+function materializeSelfExecRole(outputPath, define) {
+  const selfPath = process.execPath;
+  mkdirSync9(dirname7(outputPath), { recursive: true });
+  rmSync7(outputPath, { force: true });
+  try {
+    linkSync(selfPath, outputPath);
+  } catch {
+    copyFileSync3(selfPath, outputPath);
+  }
+  chmodSync3(outputPath, 493);
+  const role = basename5(outputPath).replace(/\.exe$/i, "");
+  writeFileSync7(`${outputPath}.rig-runconfig.json`, `${JSON.stringify({ role, define: define ?? {} }, null, 2)}
+`, { mode: 384 });
+}
+async function buildRuntimeBinary(options) {
+  return runSerializedRuntimeBinaryBuild(async () => {
+    const resolved = resolveRuntimeBinaryBuildOptions(options);
+    runBestEffortBuildGc();
+    const manifestPath = runtimeBinaryCacheManifestPath(resolved.outputPath);
+    const buildKey = createRuntimeBinaryBuildKey({
+      entrypoint: resolved.entrypoint,
+      define: resolved.define,
+      env: resolved.env,
+      external: resolved.external
+    });
+    if (await isRuntimeBinaryBuildFresh({ outputPath: resolved.outputPath, manifestPath, buildKey })) {
+      return;
+    }
+    if (shouldUseRuntimeBinaryBuildWorker()) {
+      await buildRuntimeBinaryViaWorker(resolved);
+    } else {
+      await buildRuntimeBinaryInProcess(resolved, { manifestPath, buildKey });
+    }
+    runBestEffortBuildGc();
+  });
+}
+async function buildRuntimeBinaryInProcess(options, manifest) {
+  const tempBuildDir = resolve14(dirname7(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  const tempOutputPath = resolve14(tempBuildDir, basename5(options.outputPath));
+  mkdirSync9(tempBuildDir, { recursive: true });
+  await withTemporaryEnv({
+    ...options.env,
+    ...options.define ? { RIG_BUILD_CONFIG_JSON: JSON.stringify(options.define) } : {}
+  }, async () => withTemporaryCwd(tempBuildDir, async () => {
+    const buildResult = await Bun.build({
+      entrypoints: [options.entrypoint],
+      compile: {
+        target: currentCompileTarget(),
+        outfile: tempOutputPath
+      },
+      target: "bun",
+      format: "esm",
+      minify: true,
+      bytecode: true,
+      metafile: true,
+      ...options.external ? { external: options.external } : {},
+      ...options.define ? { define: { __RIG_BUILD_CONFIG__: JSON.stringify(options.define) } } : {}
+    });
+    if (!buildResult.success) {
+      const details = buildResult.logs.map((log) => [log.message, log.position?.file ? `${log.position.file}:${log.position.line}:${log.position.column}` : ""].filter(Boolean).join(" ")).filter(Boolean).join(`
+`);
+      throw new Error(`Failed to build ${options.entrypoint}: ${details || "Bun.build() returned errors"}`);
+    }
+    if (!existsSync15(tempOutputPath)) {
+      const emitted = buildResult.outputs.map((output) => output.path).join(", ") || "(none)";
+      throw new Error(`Failed to build ${options.entrypoint}: Bun.build() did not emit ${tempOutputPath}. Emitted: ${emitted}`);
+    }
+    renameSync2(tempOutputPath, options.outputPath);
+    chmodSync3(options.outputPath, 493);
+    if (manifest) {
+      await writeRuntimeBinaryCacheManifest({
+        manifestPath: manifest.manifestPath,
+        buildKey: manifest.buildKey,
+        cwd: tempBuildDir,
+        metafile: buildResult.metafile
+      });
+    }
+  })).finally(() => {
+    rmSync7(tempBuildDir, { recursive: true, force: true });
+  });
+}
+function runBestEffortBuildGc() {
+  try {
+    drainMicrotasks();
+  } catch {}
+  try {
+    gcAndSweep();
+  } catch {}
+}
+function runtimeBinaryCacheManifestPath(outputPath) {
+  return `${outputPath}.build-manifest.json`;
+}
+function resolveRuntimeBinaryBuildOptions(options) {
+  return {
+    ...options,
+    entrypoint: resolve14(options.cwd, options.sourcePath),
+    outputPath: resolve14(options.outputPath)
+  };
+}
+function shouldUseRuntimeBinaryBuildWorker() {
+  if (process.env.RIG_RUNTIME_BUILD_WORKER === "1") {
+    return false;
+  }
+  if (process.env.RIG_RUNTIME_BUILD_IN_PROCESS === "1") {
+    return false;
+  }
+  return true;
+}
+async function buildRuntimeBinaryViaWorker(options) {
+  const workerSourcePath = resolveRuntimeBinaryBuildWorkerSourcePath(options);
+  if (!workerSourcePath || !existsSync15(workerSourcePath)) {
+    await buildRuntimeBinaryInProcess(options, {
+      manifestPath: runtimeBinaryCacheManifestPath(options.outputPath),
+      buildKey: createRuntimeBinaryBuildKey({
+        entrypoint: options.entrypoint,
+        define: options.define,
+        env: options.env,
+        external: options.external
+      })
+    });
+    return;
+  }
+  const payloadPath = createRuntimeBinaryBuildWorkerPayloadPath(options.outputPath);
+  const bunCli = resolveRuntimeBinaryBuildWorkerInvocation();
+  await Bun.write(payloadPath, `${JSON.stringify(options)}
+`);
+  const build = Bun.spawn([bunCli.command, workerSourcePath, payloadPath], {
+    cwd: options.cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: {
+      ...process.env,
+      ...options.env,
+      ...bunCli.env,
+      RIG_RUNTIME_BUILD_WORKER: "1"
+    }
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    build.exited,
+    new Response(build.stdout).text(),
+    new Response(build.stderr).text()
+  ]);
+  rmSync7(payloadPath, { force: true });
+  if (exitCode !== 0) {
+    throw new Error(`Failed to build ${options.entrypoint}: ${(stderr || stdout || `worker exited ${exitCode}`).trim()}`);
+  }
+}
+function createRuntimeBinaryBuildWorkerPayloadPath(outputPath) {
+  return resolve14(dirname7(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
+}
+function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
+  const envRoots = [
+    options.cwd?.trim(),
+    process.env.RIG_HOST_PROJECT_ROOT?.trim(),
+    process.env.PROJECT_RIG_ROOT?.trim()
+  ].filter(Boolean);
+  for (const root of envRoots) {
+    const candidate = resolve14(root, "packages/provider-plugin/src/tooling/binary-build-worker.ts");
+    if (existsSync15(candidate)) {
+      return candidate;
+    }
+  }
+  const localCandidate = resolve14(import.meta.dir, "binary-build-worker.ts");
+  return existsSync15(localCandidate) ? localCandidate : null;
+}
+function resolveRuntimeBinaryBuildWorkerInvocation() {
+  const bunPath = Bun.which("bun");
+  if (bunPath) {
+    return { command: bunPath, env: {} };
+  }
+  if (process.execPath?.trim()) {
+    return {
+      command: process.execPath,
+      env: { BUN_BE_BUN: "1" }
+    };
+  }
+  throw new Error("bun is required to run the runtime binary build worker.");
+}
+function currentCompileTarget() {
+  if (process.platform === "darwin") {
+    return process.arch === "arm64" ? "bun-darwin-arm64" : "bun-darwin-x64";
+  }
+  if (process.platform === "linux") {
+    return process.arch === "arm64" ? "bun-linux-arm64" : "bun-linux-x64";
+  }
+  return "bun-windows-x64";
+}
+function createRuntimeBinaryBuildKey(input) {
+  return JSON.stringify({
+    version: 1,
+    bunVersion: Bun.version,
+    platform: process.platform,
+    arch: process.arch,
+    entrypoint: input.entrypoint,
+    define: sortRecord(input.define),
+    external: input.external ? [...input.external].sort() : undefined,
+    env: sortRecord(input.env)
+  });
+}
+async function isRuntimeBinaryBuildFresh(input) {
+  if (!existsSync15(input.outputPath) || !existsSync15(input.manifestPath)) {
+    return false;
+  }
+  let manifest = null;
+  try {
+    manifest = await Bun.file(input.manifestPath).json();
+  } catch {
+    return false;
+  }
+  if (!manifest || manifest.version !== 1 || manifest.buildKey !== input.buildKey) {
+    return false;
+  }
+  for (const [filePath, expectedDigest] of Object.entries(manifest.inputs || {})) {
+    if (!existsSync15(filePath)) {
+      return false;
+    }
+    if (await sha256File3(filePath) !== expectedDigest) {
+      return false;
+    }
+  }
+  return true;
+}
+async function writeRuntimeBinaryCacheManifest(input) {
+  const inputs = {};
+  for (const inputPath of Object.keys(input.metafile?.inputs || {}).sort()) {
+    const normalized = normalizeBuildInputPath(input.cwd, inputPath);
+    if (!normalized || !existsSync15(normalized)) {
+      continue;
+    }
+    inputs[normalized] = await sha256File3(normalized);
+  }
+  const manifest = {
+    version: 1,
+    buildKey: input.buildKey,
+    inputs
+  };
+  await Bun.write(input.manifestPath, `${JSON.stringify(manifest, null, 2)}
+`);
+}
+function normalizeBuildInputPath(cwd, inputPath) {
+  if (!inputPath) {
+    return null;
+  }
+  if (inputPath.startsWith("file://")) {
+    return fileURLToPath(inputPath);
+  }
+  if (inputPath.startsWith("<")) {
+    return null;
+  }
+  return resolve14(cwd, inputPath);
+}
+async function sha256File3(path) {
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(await Bun.file(path).arrayBuffer());
+  return hasher.digest("hex");
+}
+function sortRecord(value) {
+  if (!value) {
+    return;
+  }
+  return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)));
+}
+async function runSerializedRuntimeBinaryBuild(action) {
+  const previous = runtimeBinaryBuildQueue;
+  let release;
+  runtimeBinaryBuildQueue = new Promise((resolve15) => {
+    release = resolve15;
+  });
+  await previous;
+  try {
+    return await action();
+  } finally {
+    release();
+  }
+}
+async function withTemporaryEnv(env, action) {
+  if (!env) {
+    return action();
+  }
+  const previousValues = new Map;
+  for (const [key, value] of Object.entries(env)) {
+    previousValues.set(key, process.env[key]);
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+  try {
+    return await action();
+  } finally {
+    for (const [key, value] of previousValues.entries()) {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+  }
+}
+async function withTemporaryCwd(cwd, action) {
+  const previousCwd = process.cwd();
+  process.chdir(cwd);
+  try {
+    return await action();
+  } finally {
+    process.chdir(previousCwd);
+  }
+}
+var runtimeBinaryBuildQueue;
+var init_runtime_binary_build = __esm(() => {
+  init_native_extract();
+  runtimeBinaryBuildQueue = Promise.resolve();
+});
+
+// packages/provider-plugin/src/tooling/claude-router-binary.ts
+var exports_claude_router_binary = {};
+__export(exports_claude_router_binary, {
+  runtimeClaudeToolRouterFileName: () => runtimeClaudeToolRouterFileName,
+  materializeClaudeToolRouterBinary: () => materializeClaudeToolRouterBinary,
+  ensureClaudeToolRouterBinaryPath: () => ensureClaudeToolRouterBinaryPath
+});
+import { chmodSync as chmodSync4, copyFileSync as copyFileSync4, existsSync as existsSync16, mkdirSync as mkdirSync10, statSync as statSync3 } from "fs";
+import { tmpdir as tmpdir4 } from "os";
+import { dirname as dirname8, resolve as resolve15 } from "path";
+function runtimeClaudeToolRouterFileName() {
+  return `rig-tool-router${process.platform === "win32" ? ".exe" : ""}`;
+}
+async function ensureClaudeToolRouterBinaryPath(projectRoot, outputPath = sharedRouterOutputPath) {
+  const sourcePath = resolve15(projectRoot, "packages/provider-plugin/src/tooling/claude-router.ts");
+  mkdirSync10(dirname8(outputPath), { recursive: true });
+  const needsBuild = !existsSync16(outputPath) || statSync3(sourcePath).mtimeMs > statSync3(outputPath).mtimeMs;
+  if (!needsBuild) {
+    return outputPath;
+  }
+  await buildRuntimeBinary({
+    sourcePath: "packages/provider-plugin/src/tooling/claude-router.ts",
+    outputPath,
+    cwd: projectRoot
+  });
+  chmodSync4(outputPath, 493);
+  return outputPath;
+}
+async function materializeClaudeToolRouterBinary(projectRoot, targetDir) {
+  if (hasEmbeddedNatives()) {
+    const targetPath2 = resolve15(targetDir, runtimeClaudeToolRouterFileName());
+    materializeSelfExecRole(targetPath2);
+    return targetPath2;
+  }
+  const sourcePath = await ensureClaudeToolRouterBinaryPath(projectRoot);
+  const targetPath = resolve15(targetDir, runtimeClaudeToolRouterFileName());
+  mkdirSync10(targetDir, { recursive: true });
+  const needsCopy = !existsSync16(targetPath) || statSync3(sourcePath).mtimeMs > statSync3(targetPath).mtimeMs;
+  if (needsCopy) {
+    copyFileSync4(sourcePath, targetPath);
+    chmodSync4(targetPath, 493);
+  }
+  return targetPath;
+}
+var sharedRouterOutputDir, sharedRouterOutputPath;
+var init_claude_router_binary = __esm(() => {
+  init_runtime_binary_build();
+  init_native_extract();
+  sharedRouterOutputDir = resolve15(tmpdir4(), "rig-native");
+  sharedRouterOutputPath = resolve15(sharedRouterOutputDir, `rig-tool-router-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+});
+
 // packages/provider-plugin/src/plugin.ts
 import { definePlugin } from "@rig/core/config";
-import { RUNTIME_INSTRUCTION_SERVICE_CAPABILITY_ID } from "@rig/contracts";
+import { defineCapability as defineCapability6 } from "@rig/core/capability";
+import { RUNTIME_INSTRUCTION, SESSION_ASSET_MATERIALIZER, TOOL_MATERIALIZER } from "@rig/contracts";
 var PROVIDER_PLUGIN_NAME = "@rig/provider-plugin";
+var DEFAULT_PROVIDER_KIND = "codex";
+var RuntimeInstructionCap = defineCapability6(RUNTIME_INSTRUCTION);
+var SessionAssetMaterializerCap = defineCapability6(SESSION_ASSET_MATERIALIZER);
+var ToolMaterializerCap = defineCapability6(TOOL_MATERIALIZER);
+var PROVIDER_SEED_ENTRYPOINTS = [
+  {
+    id: `${PROVIDER_PLUGIN_NAME}:rig-agent`,
+    basename: "rig-agent",
+    description: "Provider-owned per-runtime Rig agent entrypoint.",
+    run: async (context) => {
+      const args = [...context.argv].slice(2);
+      if (args.length === 0 || args[0] === "--help" || args[0] === "help" || args[0] === "--version" || args[0] === "-V") {
+        console.log("[rig-agent] runtime shim ready");
+        return 0;
+      }
+      const { runRigAgentEntrypoint: runRigAgentEntrypoint2 } = await Promise.resolve().then(() => (init_rig_agent_entrypoint(), exports_rig_agent_entrypoint));
+      await runRigAgentEntrypoint2();
+    }
+  },
+  {
+    id: `${PROVIDER_PLUGIN_NAME}:rig-agent-dispatch`,
+    basename: "rig-agent-dispatch",
+    description: "Provider-owned agent dispatch/provisioning shim.",
+    run: async (context) => {
+      const { runAgentWrapper: runAgentWrapper2 } = await Promise.resolve().then(() => (init_agent_wrapper(), exports_agent_wrapper));
+      const exitCode = await runAgentWrapper2({ argv: [...context.argv].slice(2) });
+      return exitCode;
+    }
+  },
+  {
+    id: `${PROVIDER_PLUGIN_NAME}:rig-browser-tool`,
+    basename: "rig-browser-tool",
+    description: "Provider-owned runtime browser helper shim.",
+    run: async (context) => {
+      const args = [...context.argv].slice(2);
+      if (args.length === 0 || args[0] === "--help" || args[0] === "help" || args[0] === "--version" || args[0] === "-V") {
+        console.log("[rig-browser-tool] runtime shim ready");
+        return 0;
+      }
+      if (context.execPath)
+        process.argv[1] = context.execPath;
+      else if (context.basename)
+        process.argv[1] = context.basename;
+      await Promise.resolve().then(() => (init_browser_tool_entrypoint(), exports_browser_tool_entrypoint));
+    }
+  },
+  {
+    id: `${PROVIDER_PLUGIN_NAME}:rig-tool-router`,
+    basename: "rig-tool-router",
+    description: "Claude-compatible provider tool router sidecar.",
+    run: async () => {
+      const { runClaudeToolRouterServer } = await import("@rig/provider-plugin/tooling/claude-router");
+      await runClaudeToolRouterServer();
+    }
+  }
+];
 var providerPlugin = definePlugin({
   name: PROVIDER_PLUGIN_NAME,
   version: "0.0.0-alpha.1",
   contributes: {
     capabilities: [
-      {
-        id: RUNTIME_INSTRUCTION_SERVICE_CAPABILITY_ID,
+      RuntimeInstructionCap.provide(async () => (await Promise.resolve().then(() => (init_service(), exports_service))).svc, {
         title: "Agent harness provider instructions",
-        description: "Provide the agent-harness file-tool contract and runtime-context instruction lines.",
-        run: async () => (await Promise.resolve().then(() => (init_service(), exports_service))).svc
-      }
-    ]
+        description: "Provide the agent-harness file-tool contract and runtime-context instruction lines."
+      }),
+      SessionAssetMaterializerCap.provide(async () => (await Promise.resolve().then(() => (init_session_asset_materializer_service(), exports_session_asset_materializer_service))).sessionAssetMaterializer, {
+        title: "Pi session asset materializer",
+        description: "Materialize plugin-contributed Pi skills and config-declared Pi packages into the workspace .pi/ directory."
+      }),
+      ToolMaterializerCap.provide(async () => {
+        const [gateway, fileTools, claudeRouter, browserTools] = await Promise.all([
+          Promise.resolve().then(() => (init_gateway(), exports_gateway)),
+          Promise.resolve().then(() => (init_file_tools(), exports_file_tools)),
+          Promise.resolve().then(() => (init_claude_router_binary(), exports_claude_router_binary)),
+          Promise.resolve().then(() => (init_browser_tools(), exports_browser_tools))
+        ]);
+        return {
+          materializeRuntimeToolGateway: gateway.materializeRuntimeToolGateway,
+          materializeRuntimeFileTools: fileTools.materializeRuntimeFileTools,
+          materializeClaudeToolRouterBinary: claudeRouter.materializeClaudeToolRouterBinary,
+          materializeRuntimeBrowserTools: browserTools.materializeRuntimeBrowserTools,
+          runtimeBrowserToolBinaryName: browserTools.runtimeBrowserToolBinaryName
+        };
+      }, {
+        title: "Runtime tool materializer",
+        description: "Materializes provider-plugin-owned tool binaries (gateway, file-tools, claude-router, browser-tools) into the runtime bin directory."
+      })
+    ],
+    seedEntrypoints: PROVIDER_SEED_ENTRYPOINTS,
+    config: { defaults: () => ({ runtime: { harness: "pi", mode: "yolo" } }) }
   }
 });
 function createProviderPlugin() {
@@ -78,5 +3429,6 @@ export {
   providerPlugin,
   plugin_default as default,
   createProviderPlugin,
-  PROVIDER_PLUGIN_NAME
+  PROVIDER_PLUGIN_NAME,
+  DEFAULT_PROVIDER_KIND
 };